Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
381651fa
Commit
381651fa
authored
Sep 26, 2016
by
antirez
Browse files
3.2.4 release notes clarifications.
parent
070d0471
Changes
1
Hide whitespace changes
Inline
Side-by-side
00-RELEASENOTES
View file @
381651fa
...
@@ -26,14 +26,25 @@ which is documented clearly here:
...
@@ -26,14 +26,25 @@ which is documented clearly here:
Thanks to Cory Duplantis of Cisco Talos for reporting the issue.
Thanks to Cory Duplantis of Cisco Talos for reporting the issue.
IMPACT:
The gist is that using CONFIG SET calls (or by manipulating redis.conf)
The gist is that using CONFIG SET calls (or by manipulating redis.conf)
an attacker is able to compromise certain fields of the "server" global
an attacker is able to compromise certain fields of the "server" global
structure, including the aof filename pointer, that could be made pointing
structure, including the aof filename pointer, that could be made pointing
to something else. In turn the AOF name is used in different contexts such
to something else. In turn the AOF name is used in different contexts such
as logging, rename(2) and open(2) syscalls, leading to potential problems.
as logging, rename(2) and open(2) syscalls, leading to potential problems.
Please note that since having access to CONFIG SET also means to be able
to change the AOF filename (and many other things) directly, this issue
actual real world impact is quite small, so I would not panik: if you
have CONFIG SET level of access, you can do more and more easily.
AFFECTED VERSIONS:
All Redis 3.2.x versions are affected.
All Redis 3.2.x versions are affected.
OTHER CHANGES IN THIS RELEASE:
This release also includes other things:
This release also includes other things:
* TCP binding bug fixed when only certain addresses were available for
* TCP binding bug fixed when only certain addresses were available for
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment