linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.

The version of Redis installed on the remote host is affected by a local information disclosure and therefore requires a security update.

Upstream 3.2.8

----

Upstream 3.2.7 (important security fix)

----

Security fix for CVE-2013-7458

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Redis team reports :

The redis-cli history file (in linenoise) is created with the default OS umask value which makes it world readable in most systems and could potentially expose authentication credentials to other users.

This update for redis fixes the following issues :

  - CVE-2013-7458: unsafe permissions of command line     history (boo#991250)

It was discovered that redis, a persistent key-value database, did not properly protect redis-cli history files: they were created by default with world-readable permissions.

Users and systems administrators may want to proactively change permissions on existing ~/rediscli_history files, instead of waiting for the updated redis-cli to do so the next time it is run.

It was discovered that the redis-cli tool in redis (an in-memory key-value database) created world-readable history files.

For Debian 7 'Wheezy', this issue has been fixed in redis version 2:2.4.14-1+deb7u1.

We recommend that you upgrade your redis packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
109322	Pivotal Software Redis < 3.2.3 Local Information Disclosure	Nessus	Misc.	low
100970	Fedora 24 : redis (2017-4b176c1694)	Nessus	Fedora Local Security Checks	low
93991	FreeBSD : redis -- sensitive information leak through command history file (fa175f30-8c75-11e6-924a-60a44ce6887b)	Nessus	FreeBSD Local Security Checks	low
92775	openSUSE Security Update : redis (openSUSE-2016-945)	Nessus	SuSE Local Security Checks	low
92642	Debian DSA-3634-1 : redis - security update	Nessus	Debian Local Security Checks	low
92640	Debian DLA-577-1 : redis security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2013-7458

low

Tenable Plugins

low

low

low

low

low

low