Security update for redis SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0295-1 Final 1 1 2023-02-07T09:39:45Z current 2023-02-07T09:39:45Z 2023-02-07T09:39:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for redis This update for redis fixes the following issues: - CVE-2022-35977: Fixed an integer overflow that could allow authenticated users to cause a crash (bsc#1207202). - CVE-2023-22458: Fixed a missing check that could allow authenticated users to cause a crash (bsc#1207203). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-295,SUSE-SLE-Module-Server-Applications-15-SP4-2023-295,openSUSE-SLE-15.4-2023-295 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230295-1/ Link for SUSE-SU-2023:0295-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013641.html E-Mail link for SUSE-SU-2023:0295-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1207202 SUSE Bug 1207202 https://bugzilla.suse.com/1207203 SUSE Bug 1207203 https://bugzilla.suse.com/1207448 SUSE Bug 1207448 https://www.suse.com/security/cve/CVE-2022-35977/ SUSE CVE CVE-2022-35977 page https://www.suse.com/security/cve/CVE-2023-22458/ SUSE CVE CVE-2023-22458 page SUSE Linux Enterprise Module for Server Applications 15 SP4 openSUSE Leap 15.4 redis-6.2.6-150400.3.11.1 redis-6.2.6-150400.3.11.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 redis-6.2.6-150400.3.11.1 as a component of openSUSE Leap 15.4 Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2022-35977 SUSE Linux Enterprise Module for Server Applications 15 SP4:redis-6.2.6-150400.3.11.1 openSUSE Leap 15.4:redis-6.2.6-150400.3.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230295-1/ https://www.suse.com/security/cve/CVE-2022-35977.html CVE-2022-35977 https://bugzilla.suse.com/1207202 SUSE Bug 1207202 Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-22458 SUSE Linux Enterprise Module for Server Applications 15 SP4:redis-6.2.6-150400.3.11.1 openSUSE Leap 15.4:redis-6.2.6-150400.3.11.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230295-1/ https://www.suse.com/security/cve/CVE-2023-22458.html CVE-2023-22458 https://bugzilla.suse.com/1207203 SUSE Bug 1207203