Date: Wed, 18 Oct 2023 14:09:33 GMT From: Yasuhiro Kimura <yasu@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 0b85db4c72d5 - main - security/vuxml: Document possible bypassing Unix socket permissions in redis Message-ID: <202310181409.39IE9XAG041104@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by yasu: URL: https://cgit.FreeBSD.org/ports/commit/?id=0b85db4c72d52b254346fda84fe7ce12d3342869 commit 0b85db4c72d52b254346fda84fe7ce12d3342869 Author: Yasuhiro Kimura <yasu@FreeBSD.org> AuthorDate: 2023-10-18 13:19:04 +0000 Commit: Yasuhiro Kimura <yasu@FreeBSD.org> CommitDate: 2023-10-18 14:08:38 +0000 security/vuxml: Document possible bypassing Unix socket permissions in redis --- security/vuxml/vuln/2023.xml | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 04ece10e1634..9bc5fae872e5 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,45 @@ + <vuln vid="8706e097-6db7-11ee-8744-080027f5fec9"> + <topic>redis -- Possible bypassing Unix socket permissions</topic> + <affects> + <package> + <name>redis</name> + <range><lt>7.2.2</lt></range> + </package> + <package> + <name>redis-devel</name> + <range><lt>7.2.2.20231018</lt></range> + </package> + <package> + <name>redis70</name> + <range><lt>7.0.14</lt></range> + </package> + <package> + <name>redis62</name> + <range><lt>6.2.14</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Redis core team reports:</p> + <blockquote cite="https://groups.google.com/g/redis-db/c/r81pHa-dcI8">; + <p> + The wrong order of listen(2) and chmod(2) calls creates a + race condition that can be used by another process to + bypass desired Unix socket permissions on startup. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2023-45145</cvename> + <url>https://groups.google.com/g/redis-db/c/r81pHa-dcI8</url>; + </references> + <dates> + <discovery>2023-10-18</discovery> + <entry>2023-10-18</entry> + </dates> + </vuln> + <vuln vid="ae0ee356-6ae1-11ee-bfb6-8c164567ca3c"> <topic>libcue -- out-of-bounds array access</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202310181409.39IE9XAG041104>