CVE-2018-11218

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.

Multiple vulnerabilities were discovered in the Lua subsystem of Redis which could result in denial of service (CVE-2018-11218, CVE-2018-11219).

These are all security issues fixed in the redis-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.

This optional update for python-redis and redis provides the following fixes

python-redis:

• Update to version to 3.4.1 (jsc#ECO-2417)

  • Move the username argument in the Redis and Connection classes to the end of the argument list. This helps those poor souls that specify all their connection options as non-keyword arguments.
  • Prior to ACL support, redis-py ignored the username component of Connection URLs. With ACL support, usernames are no longer ignored and are used to authenticate against an ACL rule. Some cloud vendors with managed Redis instances (like Heroku) provide connection URLs with a username component pre-ACL that is not intended to be used. Sending that username to Redis servers < 6.0.0 results in an error. Attempt to detect this condition and retry the AUTH command with only the password such that authentication continues to work for these users.
  • Removed the eq hooks to Redis and ConnectionPool that were added in 3.4.0. This ended up being a bad idea as two separate connection pools be considered equal yet manage a completely separate set of connections.
  • Allow empty pipelines to be executed if there are WATCHed keys. This is a convenient way to test if any of the watched keys changed without actually running any other commands.
  • Removed support for end of life Python 3.4.
  • Added support for all ACL commands in Redis 6.
  • Pipeline instances now always evaluate to True. Prior to this change, pipeline instances relied on len for boolean evaluation which meant that pipelines with no commands on the stack would be considered False.
  • Client instances and Connection pools now support a 'client_name' argument. If supplied, all connections created will call CLIENT SETNAME as soon as the connection is opened.
  • Added the 'ssl_check_hostname' argument to specify whether SSL connections should require the server hostname to match the hostname specified in the SSL cert. By default 'ssl_check_hostname' is False for backwards compatibility.
  • Added support for the TYPE argument to SCAN.
  • Better thread and fork safety in ConnectionPool and BlockingConnectionPool. Added better locking to synchronize critical sections rather than relying on CPython-specific implementation details relating to atomic operations. Adjusted how the pools identify and deal with a fork. Added a ChildDeadlockedError exception that is raised by child processes in the very unlikely chance that a deadlock is encountered.
  • Further fix for the SSLError -> TimeoutError mapping to work on obscure releases of Python 2.7.
  • Fixed a potential error handling bug for the SSLError -> TimeoutError mapping introduced in 3.3.9.
  • Mapped Python 2.7 SSLError to TimeoutError where appropriate. Timeouts should now consistently raise TimeoutErrors on Python 2.7 for both unsecured and secured connections.
  • Fixed MONITOR parsing to properly parse IPv6 client addresses
  • Fixed a regression introduced in 3.3.0
  • Resolve a race condition with the PubSubWorkerThread.
  • Response callbacks are now case insensitive.
  • Added support for hiredis-py 1.0.0 encoding error support.
  • Add READONLY and READWRITE commands.
  • Added extensive health checks that keep the connections lively.
  • Many more changes, see upstream changelog.
  • Add missing build dependency setuptools
  • Fix SentinelConnectionPool to work in multiprocess/forked environments

• Update to 3.2.0 (bsc#1131555)

  • Added support for select.poll to test whether data can be read on a socket. This should allow for significantly more connections to be used with pubsub.
  • Attempt to guarentee that the ConnectionPool hands out healthy connections. Healthy connections are those that have an established socket connection to the Redis server, are ready to accept a command and have no data available to read.
  • Use the socket.IPPROTO_TCP…