security: Update docker redis image to v7.0.15 #5063
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this PR does
Updating docker image for Redis to latest version on 7.0 branch
Which issue(s) this PR closes
commands can drive Redis to OOM panic
commands can lead to denial-of-service
commands can trigger an integer overflow, resulting in a runtime assertion
and termination of the Redis server process.
crafted pattern to trigger a denial-of-service attack on Redis, causing it to
hang and consume 100% CPU time.
an invalid hash field that will crash Redis on access
a heap overflow in the cjson and cmsgpack libraries, and result in heap
corruption and potentially remote code execution. The problem exists in all
versions of Redis with Lua scripting support, starting from 2.6, and affects
only authenticated and authorized users.
may, in some cases, trigger a heap overflow and result in reading random heap
memory, heap corruption and potentially remote code execution. Specifically:
using COMMAND GETKEYS* and validation of key names in ACL rules.
as a result may grant users executing this command access to keys that are not
explicitly authorized by the ACL configuration.
race condition that can be used by another process to bypass desired Unix
socket permissions on startup.
buffers which can result in incorrect accounting of buffer sizes and lead to
heap overflow and potential remote code execution.
Checklist
pr:no public docs
PR label added if not required)release:
). These labels dictate how your PR willshow up in the autogenerated release notes.