Bug 1390588 (CVE-2016-2121) - CVE-2016-2121 redis: weak permissions on sensitive files
Summary: CVE-2016-2121 redis: weak permissions on sensitive files
Status: CLOSED ERRATA
Alias: CVE-2016-2121
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
(Show other bugs)
Version: unspecified
Hardware: All Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20161101,reported=2...
Keywords: Security
Depends On: 1374700 1374713 1374717 1459799 1472054 1472055
Blocks: 1390589
TreeView+ depends on / blocked
 
Reported: 2016-11-01 13:25 UTC by Martin Prpič
Modified: 2017-11-16 11:43 UTC (History)
25 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-11-16 11:43:41 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:3226 normal SHIPPED_LIVE Low: redis security update 2017-11-15 18:20:08 UTC

Description Martin Prpič 2016-11-01 13:25:52 UTC
It was found that redis set weak permissions on certain files that could potentially contain sensitive information:

-rw-r--r--. 1 redis root 41599 Feb  8  2016 /etc/redis.conf
-rw-r--r--. 1 redis root  7355 Feb  8  2016 /etc/redis-sentinel.conf
drwxr-xr-x. 2 redis redis 4096 Sep  9 14:29 /var/lib/redis

This issue was originally reported in bug 1374700.

Comment 3 Lon Hohberger 2017-06-14 19:34:25 UTC
What's the recommended update? 640/750 ? Typically, things in /etc are world-readable?

Comment 4 Garth Mollett 2017-06-15 00:15:51 UTC
(In reply to Lon Hohberger from comment #3)
> What's the recommended update? 640/750 ? Typically, things in /etc are
> world-readable?

I think 640 on the two files that contain passwords (redis.conf, redis-sentinel.conf) like is already done in the newer builds should be fine.

Comment 12 Summer Long 2017-11-10 02:20:56 UTC
Acknowledgements:

Name: Honza Horak (Red Hat), Remi Collet (Red Hat)

Comment 13 errata-xmlrpc 2017-11-15 13:20:45 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:3226 https://access.redhat.com/errata/RHSA-2017:3226


Note You need to log in before you can comment on or make changes to this bug.