Skip to content

Comment on An unexpected Redis sandbox escape affecting Debian-based distrosparent

Comments

Upstream Redis doesn't. At least in my builds from upstream, luaopen_package and luaopen_os aren't even available on the binary. Debian does things differently, though. They need package in order to require the "json" and "bit" libraries, which are packaged separately on Debian.

Another thing that would be interesting and affect upstream as well would be getting the "debug" package back from the redis error function.

Ohhh okay I see. Wow :( Thanks for the clarification.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.