CVE-2015-8080

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.

Luca Bruno discovered an integer overflow flaw leading to a stack-based buffer overflow in redis, a persistent key-value database. A remote attacker can use this flaw to cause a denial of service (application crash) (CVE-2015-8080).

These are all security issues fixed in the redis-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.

This optional update for python-redis and redis provides the following fixes

python-redis:

• Update to version to 3.4.1 (jsc#ECO-2417)

  • Move the username argument in the Redis and Connection classes to the end of the argument list. This helps those poor souls that specify all their connection options as non-keyword arguments.
  • Prior to ACL support, redis-py ignored the username component of Connection URLs. With ACL support, usernames are no longer ignored and are used to authenticate against an ACL rule. Some cloud vendors with managed Redis instances (like Heroku) provide connection URLs with a username component pre-ACL that is not intended to be used. Sending that username to Redis servers < 6.0.0 results in an error. Attempt to detect this condition and retry the AUTH command with only the password such that authentication continues to work for these users.
  • Removed the eq hooks to Redis and ConnectionPool that were added in 3.4.0. This ended up being a bad idea as two separate connection pools be considered equal yet manage a completely separate set of connections.
  • Allow empty pipelines to be executed if there are WATCHed keys. This is a convenient way to test if any of the watched keys changed without actually running any other commands.
  • Removed support for end of life Python 3.4.
  • Added support for all ACL commands in Redis 6.
  • Pipeline instances now always evaluate to True. Prior to this change, pipeline instances relied on len for boolean evaluation which meant that pipelines with no commands on the stack would be considered False.
  • Client instances and Connection pools now support a 'client_name' argument. If supplied, all connections created will call CLIENT SETNAME as soon as the connection is opened.
  • Added the 'ssl_check_hostname' argument to specify whether SSL connections should require the server hostname to match the hostname specified in the SSL cert. By default 'ssl_check_hostname' is False for backwards compatibility.
  • Added support for the TYPE argument to SCAN.
  • Better thread and fork safety in ConnectionPool and BlockingConnectionPool. Added better locking to synchronize critical sections rather than relying on CPython-specific implementation details relating to atomic operations. Adjusted how the pools identify and deal with a fork. Added a ChildDeadlockedError exception that is raised by child processes in the very unlikely chance that a deadlock is encountered.
  • Further fix for the SSLError -> TimeoutError mapping to work on obscure releases of Python 2.7.
  • Fixed a potential error handling bug for the SSLError -> TimeoutError mapping introduced in 3.3.9.
  • Mapped Python 2.7 SSLError to TimeoutError where appropriate. Timeouts should now consistently raise TimeoutErrors on Python 2.7 for both unsecured and secured connections.
  • Fixed MONITOR parsing to properly parse IPv6 client addresses
  • Fixed a regression introduced in 3.3.0
  • Resolve a race condition with the PubSubWorkerThread.
  • Response callbacks are now case insensitive.
  • Added support for hiredis-py 1.0.0 encoding error support.
  • Add READONLY and READWRITE commands.
  • Added extensive health checks that keep the connections lively.
  • Many more changes, see upstream changelog.
  • Add missing build dependency setuptools
  • Fix SentinelConnectionPool to work in multiprocess/forked environments

• Update to 3.2.0 (bsc#1131555)

  • Added support for select.poll to test whether data can be read on a socket. This should allow for significantly more connections to be used with pubsub.
  • Attempt to guarentee that the ConnectionPool hands out healthy connections. Healthy connections are those that have an established socket connection to the Redis server, are ready to accept a command and have no data available to read.
  • Use the socket.IPPROTO_TCP…