-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.3140
               redis security update for OpenStack Platform
                              16 August 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           redis
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux Server 7
                   Red Hat Enterprise Linux WS/Desktop 7
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account
                   Denial of Service               -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-10192  

Reference:         ESB-2019.2644
                   ESB-2019.2537

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2019:2506

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: redis security update
Advisory ID:       RHSA-2019:2506-01
Product:           Red Hat Enterprise Linux OpenStack Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:2506
Issue date:        2019-08-15
CVE Names:         CVE-2019-10192 
=====================================================================

1. Summary:

An update for redis is now available for Red Hat OpenStack Platform 9.0
Operational Tools for RHEL 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 9.0 Operational Tools for RHEL 7 - x86_64

3. Description:

Redis is an advanced key-value store. It is often referred to as a
data-structure server since keys can contain strings, hashes, lists, sets,
and sorted sets. For performance, Redis works with an in-memory data set.
You can persist it either by dumping the data set to disk every once in a
while, or by appending each command to a log.

Security Fix(es):

* redis: Heap buffer overflow in HyperLogLog triggered by malicious client
(CVE-2019-10192)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1723918 - CVE-2019-10192 redis: Heap buffer overflow in HyperLogLog triggered by malicious client

6. Package List:

Red Hat OpenStack Platform 9.0 Operational Tools for RHEL 7:

Source:
redis-3.0.6-5.el7ost.src.rpm

x86_64:
redis-3.0.6-5.el7ost.x86_64.rpm
redis-debuginfo-3.0.6-5.el7ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-10192
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXVVnT9zjgjWX9erEAQhcjw//XIzuukP+wF2TwcvCNfV/CkVhPyGjZ/z0
n57zOUtva+e+Lm2IRXFF2jWjeDAWl82iupeYOOPqQ5sgHaJJOUceLiTh3SIdYBFP
PxtQd3+YMaHTatj73pbHlz+dqoPV/fMqBtYy9WF91fXpDm7dgpsKlhRVQ9BYpSQt
BAoRE6h6gUJBtrWmX0ACzCNAsYFnC+lVkkQm1VMvW3Xeigb/EeZxCAhJwSaly9XG
ISmfmlWLHItIPgkPvhf7I2HwoTYv7GCD/K56qR7Wjk8NoWIbH0OQQT4hUln1wSp/
iW/8TIwhoF47HXcid2FN/Q5D9Y1K+wStUh9a4R3fDIl1mD87TJTjGjlWFMZBSORC
IB9R2hAAgcInxsx3aYQmdxt0VWWayxwGWQD58jx7nHJKVDvI/uNfLCHZxSri7DPp
CA2tf5F/n3pAvAZp6kmmQOn3jCWVsHm+yTDiizVl64gVbR7wkC+kuU3tFYI1CAoy
/2jaVeqCsicS7rVU2DrdpjzGnXV8tDgrdOSHb0VRJyarBMGd6i8YitlVuiGo3WSu
SQP7LHhthM0GSargLIZyxODz11GYRoY7w1cqlwH+28qDOAUR4I7re+Id0oqNxr5g
cpq6M+TCm2gCew1m0EiJe7a6VziczhD87smgrzflCtEu8m6WvAIUJM77R3QHJEqn
jk4rGCHxS9M=
=oL9E
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: redis security update
Advisory ID:       RHSA-2019:2508-01
Product:           Red Hat Enterprise Linux OpenStack Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:2508
Issue date:        2019-08-15
CVE Names:         CVE-2019-10192 
=====================================================================

1. Summary:

An update for redis is now available for Red Hat OpenStack Platform 9.0
(Mitaka).

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 9.0 - x86_64

3. Description:

Redis is an advanced key-value store. It is often referred to as a
data-structure server since keys can contain strings, hashes, lists, sets,
and sorted sets. For performance, Redis works with an in-memory data set.
You can persist it either by dumping the data set to disk every once in a
while, or by appending each command to a log.

Security Fix(es):

* redis: Heap buffer overflow in HyperLogLog triggered by malicious client
(CVE-2019-10192)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1723918 - CVE-2019-10192 redis: Heap buffer overflow in HyperLogLog triggered by malicious client

6. Package List:

Red Hat OpenStack Platform 9.0:

Source:
redis-3.0.6-5.el7ost.src.rpm

x86_64:
redis-3.0.6-5.el7ost.x86_64.rpm
redis-debuginfo-3.0.6-5.el7ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-10192
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXVVnydzjgjWX9erEAQhvAA//beGa/CKy8kjiIy64tZdL/IYZ4oJx6GIW
geB/s+3EP/Um64fAkq6lyM0qyMcbj3hFBYDPgxNbt7XkDCFy99wT4hFsbjhNCVkK
fshsPK84Az7Nw2kPBhWesfS91dxqgSMAMD394KYTH2Piz09/ziazW8O3Xgve17IU
faa2kBo+bV7kah5ZjtIeESaVQ/Nr5sVKYja8y0c0bueRpv9tqiVUFFlDjyQDqQX/
sNl/P625KA/JK3+J4tUCgNKR1gjsaBIe92u1fZ47Cs/JaGfCd0H25990QpAdbVUx
aKaCo7ChVLZfy/xxR4zbXYvvB9Clc30kpuS/CTAPjw8E+zyC9KulWsis6dIxmvWX
W7G39J2ZWJiXiBfT6T5Xq1YGhPhZB9m3EetalY8M0KimAXGl0hAnZO2YVISawlhB
x+GCbEZ7x4ud3ErpvU6TZGOhwSCAXnjYbLDVgXC8MAf0JTNJLQWGBZBDYryhfxac
UHdKYDdOx32VUxcHO4R1ombr7r2mYJhA3LzZ6/1vLxenWN0Zrcb/5hcnnOD85sqo
n3ZDwxsW65VMMj7MVUViG+1QyNnheJxJMHjKptLWpmU8s8L7IHbkclkYgTuIzraE
xS86AMXhPiGWBb969SrsxHBTnHDS8EKnltT7Y+f0SJKHaRYP05XeggLGAFbU3YvG
IianS59OCg0=
=ZmYE
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXVX9MmaOgq3Tt24GAQjHrw/+I8QGpoPUnbYWcRNcb0iiFmsPT8VjDVgA
L/uiB8p3QYYp7aff2HgGPY5AKPyvcpenVsVAlX0ZRa/1UMnrzEJf/e02UwTxawDH
c/nIiurvDstyo2imOa6dqS44L9F2HXKUbqKk7+VBoLLqR+TD8fGiN31g+CF9Mokc
N4G1KuTJM0/dPeaVeaS0pZxzUC+qCfLVxHcbUsb9rnuFrviy4e5TqfWJGkqxvZaV
znX1XFfKaAl3KPiiEgVmjTH7eVCUhv/QkRRPxRZyA8rIBtC02+G6JMlTveCykZoi
+Wr+uiU8Y/dh1FzMUyK6ckF+DcPS5gLJRXGitiPAAqd2xi6+HQ18/vEpO2AbWDE1
UmvMIQYBpM2RcT/8teoiLau7gZ5gRWAZz32rVWquWnFgmRV9DCvyy8MNp0KuaAgV
bN8wU9a6/vcT8x+LRlKVRgovQ6HswfOn0OPFXHCq6acVXpxRaY/Lm5WW2u1GV70Q
k2CircXALI+fGxGNb66qq+UhO0+1AyXtqQRdt3oJh7kGWQE6lyFfGnRNPIixPqjh
xTXBLPZ+gRvOfiddJrsJmMeXUvaPjqWiERnwEJk7zix9q7ZjhmUjAxbqTmenKpkf
poaraIrdsyPRBXDqk/yFzjc7DKORzvaqjdtXIDheG7lxDi6jhHucSI5+KN2yUHXZ
tZJS+R37i/w=
=kRYI
-----END PGP SIGNATURE-----