Bugzilla – Bug 1061967
VUL-0: CVE-2017-15047: redis: denial of service in clusterLoadConfig function in cluster.c
Last modified: 2023-01-25 19:16:11 UTC
CVE-2017-15047 The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or possibly have unspecified other impact by leveraging "limited access to the machine." Upstream bug: https://github.com/antirez/redis/issues/4278 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15047
According to https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES this is fixed in 4.0.3 Redis 4.0.3 Released Thu Nov 30 13:14:50 CET 2017 [...] antirez in commit 1740300f: Fix buffer overflows occurring reading redis.conf. [...] https://github.com/antirez/redis/commit/1740300f35ad8a4dbb60ef7feb6a3738596316a8 Ilya, this package needs a maintainer and you did the last bump. Do you want to take over maintainership?
Yes, I want if Marcus does not mind.
I'm sorry, Martin. https://build.opensuse.org/request/show/561673
This is an autogenerated message for OBS integration: This bug (1061967) was mentioned in https://build.opensuse.org/request/show/566094 42.2+42.3+Backports:SLE-12 / redis
This is an autogenerated message for OBS integration: This bug (1061967) was mentioned in https://build.opensuse.org/request/show/568653 42.2+42.3+Backports:SLE-12 / redis
releasing, done
openSUSE-SU-2018:0225-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1061967 CVE References: CVE-2017-15047 Sources used: SUSE Package Hub for SUSE Linux Enterprise 12 (src): redis-4.0.6-12.1
openSUSE-SU-2018:0228-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1061967 CVE References: CVE-2017-15047 Sources used: openSUSE Leap 42.3 (src): redis-4.0.6-14.1 openSUSE Leap 42.2 (src): redis-4.0.6-8.6.1
SUSE-OU-2020:3291-1: An update that solves 7 vulnerabilities, contains four features and has two fixes is now available. Category: optional (moderate) Bug References: 1002351,1047218,1061967,1064980,1097430,1131555,798455,835815,991250 CVE References: CVE-2013-7458,CVE-2015-8080,CVE-2016-10517,CVE-2016-8339,CVE-2017-15047,CVE-2018-11218,CVE-2018-11219 JIRA References: ECO-2417,ECO-2867,SLE-11578,SLE-12821 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): redis-6.0.8-1.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.