Bugzilla will be upgraded to version 5.0 on December 2, 2018. The outage period for the upgrade will start at 0:00 UTC and have a duration of 12 hours
Bug 1390588 - (CVE-2016-2121) CVE-2016-2121 redis: weak permissions on sensitive files
CVE-2016-2121 redis: weak permissions on sensitive files
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20161101,reported=2...
: Security
Depends On: 1374700 1374713 1374717 1459799 1472054 1472055
Blocks: 1390589
  Show dependency treegraph
 
Reported: 2016-11-01 09:25 EDT by Martin Prpič
Modified: 2017-11-16 06:43 EST (History)
25 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-11-16 06:43:41 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:3226 normal SHIPPED_LIVE Low: redis security update 2017-11-15 13:20:08 EST

  None (edit)
Description Martin Prpič 2016-11-01 09:25:52 EDT
It was found that redis set weak permissions on certain files that could potentially contain sensitive information:

-rw-r--r--. 1 redis root 41599 Feb  8  2016 /etc/redis.conf
-rw-r--r--. 1 redis root  7355 Feb  8  2016 /etc/redis-sentinel.conf
drwxr-xr-x. 2 redis redis 4096 Sep  9 14:29 /var/lib/redis

This issue was originally reported in bug 1374700.
Comment 3 Lon Hohberger 2017-06-14 15:34:25 EDT
What's the recommended update? 640/750 ? Typically, things in /etc are world-readable?
Comment 4 Garth Mollett 2017-06-14 20:15:51 EDT
(In reply to Lon Hohberger from comment #3)
> What's the recommended update? 640/750 ? Typically, things in /etc are
> world-readable?

I think 640 on the two files that contain passwords (redis.conf, redis-sentinel.conf) like is already done in the newer builds should be fine.
Comment 12 Summer Long 2017-11-09 21:20:56 EST
Acknowledgements:

Name: Honza Horak (Red Hat), Remi Collet (Red Hat)
Comment 13 errata-xmlrpc 2017-11-15 08:20:45 EST
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:3226 https://access.redhat.com/errata/RHSA-2017:3226

Note You need to log in before you can comment on or make changes to this bug.