Author here, so feel free to ask me anything. I had to shrink the title in order for it to fit, but, as the first paragraph says, this affects only Debian and Debian-based distros, so it's a Debian bug, not a Redis bug.
If I understand correctly this RCE is mostly a big concern to hosts that don't make use of redis authentication, as eval is locked behind it? Some quick testing on my end suggests the eval command is parsed before authentication check but requires authentication for execution, but I may be wrong here.
In a perfect world we can all update immediately but when we still have some servers in Ubuntu 16.04..
Comments
Author here, so feel free to ask me anything. I had to shrink the title in order for it to fit, but, as the first paragraph says, this affects only Debian and Debian-based distros, so it's a Debian bug, not a Redis bug.
If I understand correctly this RCE is mostly a big concern to hosts that don't make use of redis authentication, as eval is locked behind it? Some quick testing on my end suggests the eval command is parsed before authentication check but requires authentication for execution, but I may be wrong here.
In a perfect world we can all update immediately but when we still have some servers in Ubuntu 16.04..
Most people probably don't use Redis authentication, and most servers are configured to not require it (including the Debian/Ubuntu defaults).
oof, and just for people who are curious but this affects Ubuntu / Ubuntu server as well being a Debian derivative.