CVE-2016-10517

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).

This update for redis to version 4.0.2 fixes the following issues:

• CVE-2016-8339: CONFIG SET client-output-buffer-limit Code Execution Vulnerability (boo#1002351)

The following upstream changes are included:

• SLOWLOG now logs the offending client name and address
• The modules native data types RDB format changed.
• The AOF check utility is now able to deal with RDB preambles.
• GEORADIUS_RO and GEORADIUSBYMEMBER_RO variants, not supporting the STORE option, were added in order to allow read-only scaling of such queries.
• HSET is now variadic, and HMSET is considered deprecated
• GEORADIUS huge radius (>= ~6000 km) corner cases fixed
• HyperLogLog commands no longer crash on certain input (non HLL) strings.
• Fixed SLAVEOF inside MULTI/EXEC blocks.
• TCP binding bug fixed when only certain addresses were available for a given por
• MIGRATE could crash the server after a socket error

This update for redis to version 4.0.2 fixes the following issues:

• CVE-2016-8339: CONFIG SET client-output-buffer-limit Code Execution Vulnerability (boo#1002351)

The following upstream changes are included:

• SLOWLOG now logs the offending client name and address
• The modules native data types RDB format changed.
• The AOF check utility is now able to deal with RDB preambles.
• GEORADIUS_RO and GEORADIUSBYMEMBER_RO variants, not supporting the STORE option, were added in order to allow read-only scaling of such queries.
• HSET is now variadic, and HMSET is considered deprecated
• GEORADIUS huge radius (>= ~6000 km) corner cases fixed
• HyperLogLog commands no longer crash on certain input (non HLL) strings.
• Fixed SLAVEOF inside MULTI/EXEC blocks.
• TCP binding bug fixed when only certain addresses were available for a given por
• MIGRATE could crash the server after a socket error

These are all security issues fixed in the redis-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.

This optional update for python-redis and redis provides the following fixes

python-redis:

• Update to version to 3.4.1 (jsc#ECO-2417)

  • Move the username argument in the Redis and Connection classes to the end of the argument list. This helps those poor souls that specify all their connection options as non-keyword arguments.
  • Prior to ACL support, redis-py ignored the username component of Connection URLs. With ACL support, usernames are no longer ignored and are used to authenticate against an ACL rule. Some cloud vendors with managed Redis instances (like Heroku) provide connection URLs with a username component pre-ACL that is not intended to be used. Sending that username to Redis servers < 6.0.0 results in an error. Attempt to detect this condition and retry the AUTH command with only the password such that authentication continues to work for these users.
  • Removed the eq hooks to Redis and ConnectionPool that were added in 3.4.0. This ended up being a bad idea as two separate connection pools be considered equal yet manage a completely separate set of connections.
  • Allow empty pipelines to be executed if there are WATCHed keys. This is a convenient way to test if any of the watched keys changed without actually running any other commands.
  • Removed support for end of life Python 3.4.
  • Added support for all ACL commands in Redis 6.
  • Pipeline instances now always evaluate to True. Prior to this change, pipeline instances relied on len for boolean evaluation which meant that pipelines with no commands on the stack would be considered False.
  • Client instances and Connection pools now support a 'client_name' argument. If supplied, all connections created will call CLIENT SETNAME as soon as the connection is opened.
  • Added the 'ssl_check_hostname' argument to specify whether SSL connections should require the server hostname to match the hostname specified in the SSL cert. By default 'ssl_check_hostname' is False for backwards compatibility.
  • Added support for the TYPE argument to SCAN.
  • Better thread and fork safety in ConnectionPool and BlockingConnectionPool. Added better locking to synchronize critical sections rather than relying on CPython-specific implementation details relating to atomic operations. Adjusted how the pools identify and deal with a fork. Added a ChildDeadlockedError exception that is raised by child processes in the very unlikely chance that a deadlock is encountered.
  • Further fix for the SSLError -> TimeoutError mapping to work on obscure releases of Python 2.7.
  • Fixed a potential error handling bug for the SSLError -> TimeoutError mapping introduced in 3.3.9.
  • Mapped Python 2.7 SSLError to TimeoutError where appropriate. Timeouts should now consistently raise TimeoutErrors on Python 2.7 for both unsecured and secured connections.
  • Fixed MONITOR parsing to properly parse IPv6 client addresses
  • Fixed a regression introduced in 3.3.0
  • Resolve a race condition with the PubSubWorkerThread.
  • Response callbacks are now case insensitive.
  • Added support for hiredis-py 1.0.0 encoding error support.
  • Add READONLY and READWRITE commands.
  • Added extensive health checks that keep the connections lively.
  • Many more changes, see upstream changelog.
  • Add missing build dependency setuptools
  • Fix SentinelConnectionPool to work in multiprocess/forked environments

• Update to 3.2.0 (bsc#1131555)

  • Added support for select.poll to test whether data can be read on a socket. This should allow for significantly more connections to be used with pubsub.
  • Attempt to guarentee that the ConnectionPool hands out healthy connections. Healthy connections are those that have an established socket connection to the Redis server, are ready to accept a command and have no data available to read.
  • Use the socket.IPPROTO_TCP…