{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for redis",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for redis fixes the following issues:\n\n- CVE-2013-7458: unsafe permissions of command line history (boo#991250)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-2016-945",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2016_1981-1.json",
         },
         {
            category: "self",
            summary: "SUSE Bug 991250",
            url: "https://bugzilla.suse.com/991250",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2013-7458 page",
            url: "https://www.suse.com/security/cve/CVE-2013-7458/",
         },
      ],
      title: "Security update for redis",
      tracking: {
         current_release_date: "2016-08-05T18:14:32Z",
         generator: {
            date: "2016-08-05T18:14:32Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2016:1981-1",
         initial_release_date: "2016-08-05T18:14:32Z",
         revision_history: [
            {
               date: "2016-08-05T18:14:32Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.0.7-6.1.aarch64",
                        product: {
                           name: "redis-3.0.7-6.1.aarch64",
                           product_id: "redis-3.0.7-6.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.0.7-6.1.ppc64le",
                        product: {
                           name: "redis-3.0.7-6.1.ppc64le",
                           product_id: "redis-3.0.7-6.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.0.7-6.1.s390x",
                        product: {
                           name: "redis-3.0.7-6.1.s390x",
                           product_id: "redis-3.0.7-6.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.0.7-6.1.x86_64",
                        product: {
                           name: "redis-3.0.7-6.1.x86_64",
                           product_id: "redis-3.0.7-6.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Package Hub 12",
                        product: {
                           name: "SUSE Package Hub 12",
                           product_id: "SUSE Package Hub 12",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:packagehub:12",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.0.7-6.1.aarch64 as component of SUSE Package Hub 12",
               product_id: "SUSE Package Hub 12:redis-3.0.7-6.1.aarch64",
            },
            product_reference: "redis-3.0.7-6.1.aarch64",
            relates_to_product_reference: "SUSE Package Hub 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.0.7-6.1.ppc64le as component of SUSE Package Hub 12",
               product_id: "SUSE Package Hub 12:redis-3.0.7-6.1.ppc64le",
            },
            product_reference: "redis-3.0.7-6.1.ppc64le",
            relates_to_product_reference: "SUSE Package Hub 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.0.7-6.1.s390x as component of SUSE Package Hub 12",
               product_id: "SUSE Package Hub 12:redis-3.0.7-6.1.s390x",
            },
            product_reference: "redis-3.0.7-6.1.s390x",
            relates_to_product_reference: "SUSE Package Hub 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.0.7-6.1.x86_64 as component of SUSE Package Hub 12",
               product_id: "SUSE Package Hub 12:redis-3.0.7-6.1.x86_64",
            },
            product_reference: "redis-3.0.7-6.1.x86_64",
            relates_to_product_reference: "SUSE Package Hub 12",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2013-7458",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2013-7458",
            },
         ],
         notes: [
            {
               category: "general",
               text: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 12:redis-3.0.7-6.1.aarch64",
               "SUSE Package Hub 12:redis-3.0.7-6.1.ppc64le",
               "SUSE Package Hub 12:redis-3.0.7-6.1.s390x",
               "SUSE Package Hub 12:redis-3.0.7-6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2013-7458",
               url: "https://www.suse.com/security/cve/CVE-2013-7458",
            },
            {
               category: "external",
               summary: "SUSE Bug 991250 for CVE-2013-7458",
               url: "https://bugzilla.suse.com/991250",
            },
            {
               category: "external",
               summary: "SUSE Bug 991387 for CVE-2013-7458",
               url: "https://bugzilla.suse.com/991387",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 12:redis-3.0.7-6.1.aarch64",
                  "SUSE Package Hub 12:redis-3.0.7-6.1.ppc64le",
                  "SUSE Package Hub 12:redis-3.0.7-6.1.s390x",
                  "SUSE Package Hub 12:redis-3.0.7-6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-08-05T18:14:32Z",
               details: "low",
            },
         ],
         title: "CVE-2013-7458",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "redis-3.2.4-1.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the redis-3.2.4-1.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-10552",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10552-1.json",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2013-7458 page",
            url: "https://www.suse.com/security/cve/CVE-2013-7458/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-8339 page",
            url: "https://www.suse.com/security/cve/CVE-2016-8339/",
         },
      ],
      title: "redis-3.2.4-1.1 on GA media",
      tracking: {
         current_release_date: "2024-06-15T00:00:00Z",
         generator: {
            date: "2024-06-15T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:10552-1",
         initial_release_date: "2024-06-15T00:00:00Z",
         revision_history: [
            {
               date: "2024-06-15T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.2.4-1.1.aarch64",
                        product: {
                           name: "redis-3.2.4-1.1.aarch64",
                           product_id: "redis-3.2.4-1.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.2.4-1.1.ppc64le",
                        product: {
                           name: "redis-3.2.4-1.1.ppc64le",
                           product_id: "redis-3.2.4-1.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.2.4-1.1.s390x",
                        product: {
                           name: "redis-3.2.4-1.1.s390x",
                           product_id: "redis-3.2.4-1.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.2.4-1.1.x86_64",
                        product: {
                           name: "redis-3.2.4-1.1.x86_64",
                           product_id: "redis-3.2.4-1.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.2.4-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:redis-3.2.4-1.1.aarch64",
            },
            product_reference: "redis-3.2.4-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.2.4-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:redis-3.2.4-1.1.ppc64le",
            },
            product_reference: "redis-3.2.4-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.2.4-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:redis-3.2.4-1.1.s390x",
            },
            product_reference: "redis-3.2.4-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.2.4-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:redis-3.2.4-1.1.x86_64",
            },
            product_reference: "redis-3.2.4-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2013-7458",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2013-7458",
            },
         ],
         notes: [
            {
               category: "general",
               text: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:redis-3.2.4-1.1.aarch64",
               "openSUSE Tumbleweed:redis-3.2.4-1.1.ppc64le",
               "openSUSE Tumbleweed:redis-3.2.4-1.1.s390x",
               "openSUSE Tumbleweed:redis-3.2.4-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2013-7458",
               url: "https://www.suse.com/security/cve/CVE-2013-7458",
            },
            {
               category: "external",
               summary: "SUSE Bug 991250 for CVE-2013-7458",
               url: "https://bugzilla.suse.com/991250",
            },
            {
               category: "external",
               summary: "SUSE Bug 991387 for CVE-2013-7458",
               url: "https://bugzilla.suse.com/991387",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.aarch64",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.ppc64le",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.s390x",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "low",
            },
         ],
         title: "CVE-2013-7458",
      },
      {
         cve: "CVE-2016-8339",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-8339",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:redis-3.2.4-1.1.aarch64",
               "openSUSE Tumbleweed:redis-3.2.4-1.1.ppc64le",
               "openSUSE Tumbleweed:redis-3.2.4-1.1.s390x",
               "openSUSE Tumbleweed:redis-3.2.4-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-8339",
               url: "https://www.suse.com/security/cve/CVE-2016-8339",
            },
            {
               category: "external",
               summary: "SUSE Bug 1002351 for CVE-2016-8339",
               url: "https://bugzilla.suse.com/1002351",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.aarch64",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.ppc64le",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.s390x",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.aarch64",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.ppc64le",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.s390x",
                  "openSUSE Tumbleweed:redis-3.2.4-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2016-8339",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for redis",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for redis fixes the following issues:\n\n- CVE-2013-7458: unsafe permissions of command line history (boo#991250)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-2016-945",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2016_1980-1.json",
         },
         {
            category: "self",
            summary: "SUSE Bug 991250",
            url: "https://bugzilla.suse.com/991250",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2013-7458 page",
            url: "https://www.suse.com/security/cve/CVE-2013-7458/",
         },
      ],
      title: "Security update for redis",
      tracking: {
         current_release_date: "2016-08-05T18:14:32Z",
         generator: {
            date: "2016-08-05T18:14:32Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2016:1980-1",
         initial_release_date: "2016-08-05T18:14:32Z",
         revision_history: [
            {
               date: "2016-08-05T18:14:32Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.0.7-6.1.aarch64",
                        product: {
                           name: "redis-3.0.7-6.1.aarch64",
                           product_id: "redis-3.0.7-6.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.0.7-6.1.ppc64le",
                        product: {
                           name: "redis-3.0.7-6.1.ppc64le",
                           product_id: "redis-3.0.7-6.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.0.7-6.1.s390x",
                        product: {
                           name: "redis-3.0.7-6.1.s390x",
                           product_id: "redis-3.0.7-6.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-3.0.7-6.1.x86_64",
                        product: {
                           name: "redis-3.0.7-6.1.x86_64",
                           product_id: "redis-3.0.7-6.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Package Hub 12",
                        product: {
                           name: "SUSE Package Hub 12",
                           product_id: "SUSE Package Hub 12",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:packagehub:12",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.0.7-6.1.aarch64 as component of SUSE Package Hub 12",
               product_id: "SUSE Package Hub 12:redis-3.0.7-6.1.aarch64",
            },
            product_reference: "redis-3.0.7-6.1.aarch64",
            relates_to_product_reference: "SUSE Package Hub 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.0.7-6.1.ppc64le as component of SUSE Package Hub 12",
               product_id: "SUSE Package Hub 12:redis-3.0.7-6.1.ppc64le",
            },
            product_reference: "redis-3.0.7-6.1.ppc64le",
            relates_to_product_reference: "SUSE Package Hub 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.0.7-6.1.s390x as component of SUSE Package Hub 12",
               product_id: "SUSE Package Hub 12:redis-3.0.7-6.1.s390x",
            },
            product_reference: "redis-3.0.7-6.1.s390x",
            relates_to_product_reference: "SUSE Package Hub 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-3.0.7-6.1.x86_64 as component of SUSE Package Hub 12",
               product_id: "SUSE Package Hub 12:redis-3.0.7-6.1.x86_64",
            },
            product_reference: "redis-3.0.7-6.1.x86_64",
            relates_to_product_reference: "SUSE Package Hub 12",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2013-7458",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2013-7458",
            },
         ],
         notes: [
            {
               category: "general",
               text: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 12:redis-3.0.7-6.1.aarch64",
               "SUSE Package Hub 12:redis-3.0.7-6.1.ppc64le",
               "SUSE Package Hub 12:redis-3.0.7-6.1.s390x",
               "SUSE Package Hub 12:redis-3.0.7-6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2013-7458",
               url: "https://www.suse.com/security/cve/CVE-2013-7458",
            },
            {
               category: "external",
               summary: "SUSE Bug 991250 for CVE-2013-7458",
               url: "https://bugzilla.suse.com/991250",
            },
            {
               category: "external",
               summary: "SUSE Bug 991387 for CVE-2013-7458",
               url: "https://bugzilla.suse.com/991387",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 12:redis-3.0.7-6.1.aarch64",
                  "SUSE Package Hub 12:redis-3.0.7-6.1.ppc64le",
                  "SUSE Package Hub 12:redis-3.0.7-6.1.s390x",
                  "SUSE Package Hub 12:redis-3.0.7-6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-08-05T18:14:32Z",
               details: "low",
            },
         ],
         title: "CVE-2013-7458",
      },
   ],
}

{
   affected: [],
   aliases: [
      "CVE-2013-7458",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-200",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2016-08-10T14:59:00Z",
      severity: "LOW",
   },
   details: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
   id: "GHSA-gfx7-7mf7-vcxx",
   modified: "2022-05-14T03:09:09Z",
   published: "2022-05-14T03:09:09Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7458",
      },
      {
         type: "WEB",
         url: "https://github.com/antirez/linenoise/issues/121",
      },
      {
         type: "WEB",
         url: "https://github.com/antirez/redis/issues/3284",
      },
      {
         type: "WEB",
         url: "https://github.com/antirez/linenoise/pull/122",
      },
      {
         type: "WEB",
         url: "https://github.com/antirez/redis/pull/1418",
      },
      {
         type: "WEB",
         url: "https://github.com/antirez/redis/pull/3322",
      },
      {
         type: "WEB",
         url: "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460",
      },
      {
         type: "WEB",
         url: "https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES",
      },
      {
         type: "WEB",
         url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html",
      },
      {
         type: "WEB",
         url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html",
      },
      {
         type: "WEB",
         url: "http://www.debian.org/security/2016/dsa-3634",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
         type: "CVSS_V3",
      },
   ],
}

{
   GSD: {
      alias: "CVE-2013-7458",
      description: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
      id: "GSD-2013-7458",
      references: [
         "https://www.suse.com/security/cve/CVE-2013-7458.html",
         "https://www.debian.org/security/2016/dsa-3634",
         "https://advisories.mageia.org/CVE-2013-7458.html",
      ],
   },
   gsd: {
      metadata: {
         exploitCode: "unknown",
         remediation: "unknown",
         reportConfidence: "confirmed",
         type: "vulnerability",
      },
      osvSchema: {
         aliases: [
            "CVE-2013-7458",
         ],
         details: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
         id: "GSD-2013-7458",
         modified: "2023-12-13T01:22:18.613525Z",
         schema_version: "1.4.0",
      },
   },
   namespaces: {
      "cve.org": {
         CVE_data_meta: {
            ASSIGNER: "security@debian.org",
            ID: "CVE-2013-7458",
            STATE: "PUBLIC",
         },
         affects: {
            vendor: {
               vendor_data: [
                  {
                     product: {
                        product_data: [
                           {
                              product_name: "n/a",
                              version: {
                                 version_data: [
                                    {
                                       version_value: "n/a",
                                    },
                                 ],
                              },
                           },
                        ],
                     },
                     vendor_name: "n/a",
                  },
               ],
            },
         },
         data_format: "MITRE",
         data_type: "CVE",
         data_version: "4.0",
         description: {
            description_data: [
               {
                  lang: "eng",
                  value: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
               },
            ],
         },
         problemtype: {
            problemtype_data: [
               {
                  description: [
                     {
                        lang: "eng",
                        value: "n/a",
                     },
                  ],
               },
            ],
         },
         references: {
            reference_data: [
               {
                  name: "https://github.com/antirez/redis/pull/3322",
                  refsource: "CONFIRM",
                  url: "https://github.com/antirez/redis/pull/3322",
               },
               {
                  name: "openSUSE-SU-2016:1981",
                  refsource: "SUSE",
                  url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html",
               },
               {
                  name: "https://github.com/antirez/redis/pull/1418",
                  refsource: "CONFIRM",
                  url: "https://github.com/antirez/redis/pull/1418",
               },
               {
                  name: "https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES",
                  refsource: "CONFIRM",
                  url: "https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES",
               },
               {
                  name: "openSUSE-SU-2016:1980",
                  refsource: "SUSE",
                  url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html",
               },
               {
                  name: "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460",
                  refsource: "CONFIRM",
                  url: "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460",
               },
               {
                  name: "https://github.com/antirez/linenoise/issues/121",
                  refsource: "CONFIRM",
                  url: "https://github.com/antirez/linenoise/issues/121",
               },
               {
                  name: "https://github.com/antirez/linenoise/pull/122",
                  refsource: "CONFIRM",
                  url: "https://github.com/antirez/linenoise/pull/122",
               },
               {
                  name: "DSA-3634",
                  refsource: "DEBIAN",
                  url: "http://www.debian.org/security/2016/dsa-3634",
               },
               {
                  name: "https://github.com/antirez/redis/issues/3284",
                  refsource: "CONFIRM",
                  url: "https://github.com/antirez/redis/issues/3284",
               },
            ],
         },
      },
      "nvd.nist.gov": {
         configurations: {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndIncluding: "3.2.2",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
         cve: {
            CVE_data_meta: {
               ASSIGNER: "security@debian.org",
               ID: "CVE-2013-7458",
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "en",
                     value: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "en",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/antirez/redis/issues/3284",
                     refsource: "CONFIRM",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/antirez/redis/issues/3284",
                  },
                  {
                     name: "https://github.com/antirez/redis/pull/3322",
                     refsource: "CONFIRM",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/antirez/redis/pull/3322",
                  },
                  {
                     name: "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460",
                     refsource: "CONFIRM",
                     tags: [
                        "Mailing List",
                        "Third Party Advisory",
                     ],
                     url: "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460",
                  },
                  {
                     name: "https://github.com/antirez/linenoise/pull/122",
                     refsource: "CONFIRM",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/antirez/linenoise/pull/122",
                  },
                  {
                     name: "https://github.com/antirez/linenoise/issues/121",
                     refsource: "CONFIRM",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/antirez/linenoise/issues/121",
                  },
                  {
                     name: "https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES",
                     refsource: "CONFIRM",
                     tags: [
                        "Release Notes",
                     ],
                     url: "https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES",
                  },
                  {
                     name: "https://github.com/antirez/redis/pull/1418",
                     refsource: "CONFIRM",
                     tags: [
                        "Issue Tracking",
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/antirez/redis/pull/1418",
                  },
                  {
                     name: "DSA-3634",
                     refsource: "DEBIAN",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "http://www.debian.org/security/2016/dsa-3634",
                  },
                  {
                     name: "openSUSE-SU-2016:1981",
                     refsource: "SUSE",
                     tags: [
                        "Mailing List",
                        "Third Party Advisory",
                     ],
                     url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html",
                  },
                  {
                     name: "openSUSE-SU-2016:1980",
                     refsource: "SUSE",
                     tags: [
                        "Mailing List",
                        "Third Party Advisory",
                     ],
                     url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html",
                  },
               ],
            },
         },
         impact: {
            baseMetricV2: {
               cvssV2: {
                  accessComplexity: "LOW",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 2.1,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               exploitabilityScore: 3.9,
               impactScore: 2.9,
               obtainAllPrivilege: false,
               obtainOtherPrivilege: false,
               obtainUserPrivilege: false,
               severity: "LOW",
               userInteractionRequired: false,
            },
            baseMetricV3: {
               cvssV3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               exploitabilityScore: 1.8,
               impactScore: 1.4,
            },
         },
         lastModifiedDate: "2018-08-08T13:49Z",
         publishedDate: "2016-08-10T14:59Z",
      },
   },
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "56B5FAD2-11E8-4033-B787-B43C5FBCB779",
                     versionEndIncluding: "3.2.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
      },
      {
         lang: "es",
         value: "linenoise, tal y como se utiliza en Redis en versiones anteriores a 3.2.3, utiliza permisos accesibles a todos para .rediscli_history, lo que permite a usuarios locales obtener información sensible leyendo el archivo.",
      },
   ],
   id: "CVE-2013-7458",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 2.1,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2016-08-10T14:59:00.143",
   references: [
      {
         source: "security@debian.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html",
      },
      {
         source: "security@debian.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html",
      },
      {
         source: "security@debian.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.debian.org/security/2016/dsa-3634",
      },
      {
         source: "security@debian.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460",
      },
      {
         source: "security@debian.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/linenoise/issues/121",
      },
      {
         source: "security@debian.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/linenoise/pull/122",
      },
      {
         source: "security@debian.org",
         tags: [
            "Release Notes",
         ],
         url: "https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES",
      },
      {
         source: "security@debian.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/redis/issues/3284",
      },
      {
         source: "security@debian.org",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/redis/pull/1418",
      },
      {
         source: "security@debian.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/redis/pull/3322",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.debian.org/security/2016/dsa-3634",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/linenoise/issues/121",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/linenoise/pull/122",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/redis/issues/3284",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/redis/pull/1418",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/antirez/redis/pull/3322",
      },
   ],
   sourceIdentifier: "security@debian.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Optional update for python-redis and redis",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This optional update for python-redis and redis provides the following fixes\n\npython-redis:\n\n- Update to version to 3.4.1 (jsc#ECO-2417)\n  * Move the username argument in the Redis and Connection classes to the end of the argument list. \n    This helps those poor souls that specify all their connection options as non-keyword arguments.\n  * Prior to ACL support, redis-py ignored the username component of Connection URLs. With ACL \n    support, usernames are no longer ignored and are used to authenticate against an ACL rule. \n    Some cloud vendors with managed Redis instances (like Heroku) provide connection URLs with a\n    username component pre-ACL that is not intended to be used. Sending that username to Redis \n    servers < 6.0.0 results in an error. Attempt to detect this condition and retry the AUTH \n    command with only the password such that authentication continues to work for these users.\n  * Removed the __eq__ hooks to Redis and ConnectionPool that were added in 3.4.0. \n    This ended up being a bad idea as two separate connection pools be considered equal yet \n    manage a completely separate set of connections.\n  * Allow empty pipelines to be executed if there are WATCHed keys. This is a convenient \n    way to test if any of the watched keys changed without actually running any other commands. \n  * Removed support for end of life Python 3.4.\n  * Added support for all ACL commands in Redis 6. \n  * Pipeline instances now always evaluate to True. Prior to this change,\n    pipeline instances relied on __len__ for boolean evaluation which\n    meant that pipelines with no commands on the stack would be considered False.\n  * Client instances and Connection pools now support a 'client_name' argument. \n    If supplied, all connections created will call CLIENT SETNAME as soon as the connection is opened. \n  * Added the 'ssl_check_hostname' argument to specify whether SSL connections should require the \n    server hostname to match the hostname specified in the SSL cert. By default 'ssl_check_hostname' \n    is False for backwards compatibility. \n  * Added support for the TYPE argument to SCAN. \n  * Better thread and fork safety in ConnectionPool and BlockingConnectionPool. \n    Added better locking to synchronize critical sections rather than relying on CPython-specific implementation \n    details relating to atomic operations. Adjusted how the pools identify and deal with a fork. \n    Added a ChildDeadlockedError exception that is raised by child processes in the very unlikely chance that \n    a deadlock is encountered. \n  * Further fix for the SSLError -> TimeoutError mapping to work on obscure releases of Python 2.7.\n  * Fixed a potential error handling bug for the SSLError ->\n    TimeoutError mapping introduced in 3.3.9.\n  * Mapped Python 2.7 SSLError to TimeoutError where\n    appropriate. Timeouts should now consistently raise TimeoutErrors\n    on Python 2.7 for both unsecured and secured connections. \n  * Fixed MONITOR parsing to properly parse IPv6 client addresses\n  * Fixed a regression introduced in 3.3.0\n  * Resolve a race condition with the PubSubWorkerThread.\n  * Response callbacks are now case insensitive.\n  * Added support for hiredis-py 1.0.0 encoding error support.\n  * Add READONLY and READWRITE commands.\n  * Added extensive health checks that keep the connections lively.\n  * Many more changes, see upstream changelog.\n  * Add missing build dependency setuptools\n  * Fix SentinelConnectionPool to work in multiprocess/forked environments\n\n- Update to 3.2.0 (bsc#1131555)\n  * Added support for `select.poll` to test whether data can be read on a socket. This should allow for significantly\n    more connections to be used with pubsub. \n  * Attempt to guarentee that the ConnectionPool hands out healthy connections. Healthy connections are those that \n    have an established socket connection to the Redis server, are ready to accept a command and have no data \n    available to read. \n  * Use the socket.IPPROTO_TCP constant instead of socket.SOL_TCP. IPPROTO_TCP is available on \n    more interpreters (Jython for instance).\n  * Fixed a regression introduced in 3.0 that mishandles exceptions not derived from the base Exception class. \n    KeyboardInterrupt and gevent.timeout notable. \n  * Significant improvements to handing connections with forked processes. Parent and child processes no longer \n    trample on each others' connections.\n  * PythonParser no longer closes the associated connection's socket. The connection itself will close the socket.\n  * Connection URLs must have one of the following schemes: redis://, rediss://, unix://. \n  * Fixed an issue with retry_on_timeout logic that caused some TimeoutErrors to be retried. \n  * Added support for SNI for SSL. \n  * Fixed ConnectionPool repr for pools with no connections. \n  * Fixed GEOHASH to return a None value when specifying a place that doesn't exist on the server. \n  * Fixed XREADGROUP to return an empty dictionary for messages that have been deleted but still exist in the \n    unacknowledged queue. \n  * Added an owned method to Lock objects. owned returns a boolean indicating whether the current lock instance \n    still owns the lock.\n  * Allow lock.acquire() to accept an optional token argument. If provided, the token argument is used as the \n    unique value used to claim the lock. \n  * Added a reacquire method to Lock objects. reaquire attempts to renew the lock such that the timeout is \n    extended to the same value that the lock was initially acquired with. \n  * Stream names found within XREAD and XREADGROUP responses now properly respect the decode_responses flag.\n  * XPENDING_RANGE now requires the user the specify the min, max and count arguments. \n    Newer versions of Redis prevent count from being infinite so it's left to the user to specify these values \n    explicitly.\n  * ZADD now returns None when xx=True and incr=True and an element is specified that doesn't exist in \n    the sorted set. This matches what the server returns in this case. \n  * Added client_kill_filter that accepts various filters to identify and kill clients. \n  * Fixed a race condition that occurred when unsubscribing and resubscribing to the same channel or pattern\n    in rapid succession.\n  * Added a LockNotOwnedError that is raised when trying to extend or release a lock that is no longer owned. \n    This is a subclass of LockError so previous code should continue to work as expected. \n  * Fixed a bug in GEORADIUS that forced decoding of places without respecting the decode_responses option. \n  * add recommendation for python-hiredis\n  * Fixed regression with UnixDomainSocketConnection caused by 3.0.0.\n  * Fixed an issue with the new asynchronous flag on flushdb and flushall.\n  * Updated Lock.locked() method to indicate whether *any* process has acquired the lock, not just the \n    current one. This is in line with the behavior of threading.Lock. \n\n- Update to version 3.0.0:\n  BACKWARDS INCOMPATIBLE CHANGES\n  * When using a Lock as a context manager and the lock fails to be acquired\n    a LockError is now raised. This prevents the code block inside the context manager from being executed \n    if the lock could not be acquired.\n  * Renamed LuaLock to Lock.\n  * Removed the pipeline based Lock implementation in favor of the LuaLock implementation.\n  * Only bytes, strings and numbers (ints, longs and floats) are acceptable\n    for keys and values. Previously redis-py attempted to cast other types\n    to str() and store the result. This caused must confusion and frustration\n    when passing boolean values (cast to 'True' and 'False') or None values\n    (cast to 'None'). It is now the user's responsibility to cast all\n    key names and values to bytes, strings or numbers before passing the value to redis-py.\n  * The StrictRedis class has been renamed to Redis. StrictRedis will\n    continue to exist as an alias of Redis for the forseeable future.\n  * The legacy Redis client class has been removed. It caused much confusion to users.\n  * ZINCRBY arguments 'value' and 'amount' have swapped order to match the\n    the Redis server. The new argument order is: keyname, amount, value.\n  * MGET no longer raises an error if zero keys are passed in. Instead an empty list is returned.\n  * MSET and MSETNX now require all keys/values to be specified in a single dictionary argument named mapping. \n    This was changed to allow for future options to these commands in the future.\n  * ZADD now requires all element names/scores be specified in a single\n    dictionary argument named mapping. This was required to allow the NX, XX, CH and INCR options to be specified.\n  OTHER CHANGES\n  * Added missing DECRBY command.\n  * CLUSTER INFO and CLUSTER NODES respones are now properly decoded to strings.\n  * Added a 'locked()' method to Lock objects. This method returns True if the lock has been acquired and owned \n    by the current process, otherwise False.\n  * EXISTS now supports multiple keys. It's return value is now the number of keys in the list that exist.\n  * Ensure all commands can accept key names as bytes. This fixes issues with BLPOP, BRPOP and SORT.\n  * All errors resulting from bad user input are raised as DataError exceptions. DataError is a subclass of \n    RedisError so this should be transparent to anyone previously catching these.\n  * Added support for NX, XX, CH and INCR options to ZADD\n  * Added support for the MIGRATE command\n  * Added support for the MEMORY USAGE and MEMORY PURGE commands. \n  * Added support for the 'asynchronous' argument to FLUSHDB and FLUSHALL commands. \n  * Added support for the BITFIELD command. \n  * Improved performance on pipeline requests with large chunks of data.\n  * Fixed test suite to not fail if another client is connected to the server the tests are running against.\n  * Added support for SWAPDB.\n  * Added support for all STREAM commands.\n  * SHUTDOWN now accepts the 'save' and 'nosave' arguments. \n  * Added support for ZPOPMAX, ZPOPMIN, BZPOPMAX, BZPOPMIN. \n  * Added support for the 'type' argument in CLIENT LIST.\n  * Added support for CLIENT PAUSE. \n  * Added support for CLIENT ID and CLIENT UNBLOCK. \n  * GEODIST now returns a None value when referencing a place that does not exist. \n  * Added a ping() method to pubsub objects. \n  * Fixed a bug with keys in the INFO dict that contained ':' symbols.\n  * ssl_cert_reqs now has a default value of 'required' by default. This should make connecting to a remote \n    Redis server over SSL more secure.\n  * max_connections is now a valid querystring argument for creating connection pools from URLs. \n  * Added the UNLINK command.\n  * Added socket_type option to Connection for configurability.\n  * Lock.do_acquire now atomically sets acquires the lock and sets the expire value via set(nx=True, px=timeout).\n  * Added 'count' argument to SPOP.\n  * Fixed an issue parsing client_list respones that contained an '='.\n  * Fix rounding issues with geolocation, it is not stable enought to produce pinpoint equal \n    results among 32bit platforms\n  * Run tests by launching redis server\n  * Require redis on runtime\n\nredis:\n\n- Update to version 6.0.8 \n    (jsc#PM-1615, jsc#PM-1622, jsc#PM-1681, jsc#ECO-2867, jsc#PM-1547, jsc#CAPS-56, jsc#SLE-11578, jsc#SLE-12821)\n  * bug fixes when using with Sentinel\n  * bug fixes when using CONFIG REWRITE\n  * Remove THP warning when set to madvise\n  * Allow EXEC with read commands on readonly replica in cluster\n  * Add masters/replicas options to redis-cli --cluster call command\n  * CONFIG SET could hung the client when arrives during RDB/ROF loading\n  * LPOS command when RANK is greater than matches responded with broken protocol\n  * Add oom-score-adj configuration option to control Linux OOM killer\n  * Show IO threads statistics and status in INFO output \n  * Add optional tls verification mode (see tls-auth-clients)\n  * Fix crash when enabling CLIENT TRACKING with prefix\n  * EXEC always fails with EXECABORT and multi-state is cleared\n  * RESTORE ABSTTL won't store expired keys into the db\n  * redis-cli better handling of non-pritable key names\n  * TLS: Ignore client cert when tls-auth-clients off\n  * Tracking: fix invalidation message on flush\n  * Notify systemd on Sentinel startup\n  * Fix crash on a misuse of STRALGO\n  * Fix a few rare leaks (STRALGO error misuse, Sentinel)\n  * Fix a possible invalid access in defrag of scripts\n  * Add LPOS command to search in a list\n  * Use user+pass for MIGRATE in redis-cli and redis-benchmark in cluster mode\n  * redis-cli support TLS for --pipe, --rdb and --replica options\n  * TLS: Session caching configuration support\n  * Fix handling of speical chars in ACL LOAD\n  * Make Redis Cluster more robust about operation errors that may lead to two clusters to mix together\n  * Revert the sendfile() implementation of RDB transfer\n  * Fix TLS certificate loading for chained certificates\n  * Fix AOF rewirting of KEEPTTL SET option\n  * Fix MULTI/EXEC behavior during -BUSY script errors\n  * fix a severe replication bug introduced in Redis 6 by the 'meaningful offset' feature\n  * fix a crash introduced in 6.0.2\n  * fix to client side caching when keys are evicted from the tracking table but no notifications are sent\n  * add BR pkgconfig(libsystemd) for the rewritten systemd support and force building with it\n  * XCLAIM AOF/replicas propagation fixed.\n  * Client side caching: new NOLOOP option to avoid getting notified about changes performed by ourselves.\n  * ACL GENPASS now uses HMAC-SHA256 and have an optional 'bits' argument.  It means you can use it as a general \n    purpose 'secure random strings' primitive!\n  * Cluster 'SLOTS' subcommand memory optimization.\n  * The LCS command is now a subcommand of STRALGO.\n  * Meaningful offset for replicas as well. More successful partial resynchronizations.\n  * Optimize memory usage of deferred replies.\n  * Faster CRC64 algorithm for faster RDB loading.\n  * XINFO STREAM FULL, a new subcommand to get the whole stream state.\n  * CLIENT KILL USER <username>.\n  * MIGRATE AUTH2 option, for ACL style authentication support.\n  * use libatomic also on ppc\n  * add hash file from redis-hashes and verify it during build\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2020-3291,SUSE-SLE-Module-Server-Applications-15-SP2-2020-3291",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-ou-2020_3291-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-OU-2020:3291-1",
            url: "https://www.suse.com/support/update/announcement//suse-ou-20203291-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-OU-2020:3291-1",
            url: "https://lists.suse.com/pipermail/sle-updates/2020-November/016846.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1002351",
            url: "https://bugzilla.suse.com/1002351",
         },
         {
            category: "self",
            summary: "SUSE Bug 1047218",
            url: "https://bugzilla.suse.com/1047218",
         },
         {
            category: "self",
            summary: "SUSE Bug 1061967",
            url: "https://bugzilla.suse.com/1061967",
         },
         {
            category: "self",
            summary: "SUSE Bug 1064980",
            url: "https://bugzilla.suse.com/1064980",
         },
         {
            category: "self",
            summary: "SUSE Bug 1097430",
            url: "https://bugzilla.suse.com/1097430",
         },
         {
            category: "self",
            summary: "SUSE Bug 1131555",
            url: "https://bugzilla.suse.com/1131555",
         },
         {
            category: "self",
            summary: "SUSE Bug 798455",
            url: "https://bugzilla.suse.com/798455",
         },
         {
            category: "self",
            summary: "SUSE Bug 835815",
            url: "https://bugzilla.suse.com/835815",
         },
         {
            category: "self",
            summary: "SUSE Bug 991250",
            url: "https://bugzilla.suse.com/991250",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2013-7458 page",
            url: "https://www.suse.com/security/cve/CVE-2013-7458/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2015-8080 page",
            url: "https://www.suse.com/security/cve/CVE-2015-8080/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-10517 page",
            url: "https://www.suse.com/security/cve/CVE-2016-10517/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-8339 page",
            url: "https://www.suse.com/security/cve/CVE-2016-8339/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-15047 page",
            url: "https://www.suse.com/security/cve/CVE-2017-15047/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-11218 page",
            url: "https://www.suse.com/security/cve/CVE-2018-11218/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-11219 page",
            url: "https://www.suse.com/security/cve/CVE-2018-11219/",
         },
      ],
      title: "Optional update for python-redis and redis",
      tracking: {
         current_release_date: "2020-11-11T11:26:43Z",
         generator: {
            date: "2020-11-11T11:26:43Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-OU-2020:3291-1",
         initial_release_date: "2020-11-11T11:26:43Z",
         revision_history: [
            {
               date: "2020-11-11T11:26:43Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-6.0.8-1.3.1.aarch64",
                        product: {
                           name: "redis-6.0.8-1.3.1.aarch64",
                           product_id: "redis-6.0.8-1.3.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-6.0.8-1.3.1.i586",
                        product: {
                           name: "redis-6.0.8-1.3.1.i586",
                           product_id: "redis-6.0.8-1.3.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python2-redis-3.4.1-3.3.1.noarch",
                        product: {
                           name: "python2-redis-3.4.1-3.3.1.noarch",
                           product_id: "python2-redis-3.4.1-3.3.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-redis-3.4.1-3.3.1.noarch",
                        product: {
                           name: "python3-redis-3.4.1-3.3.1.noarch",
                           product_id: "python3-redis-3.4.1-3.3.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-6.0.8-1.3.1.ppc64le",
                        product: {
                           name: "redis-6.0.8-1.3.1.ppc64le",
                           product_id: "redis-6.0.8-1.3.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-6.0.8-1.3.1.s390x",
                        product: {
                           name: "redis-6.0.8-1.3.1.s390x",
                           product_id: "redis-6.0.8-1.3.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "redis-6.0.8-1.3.1.x86_64",
                        product: {
                           name: "redis-6.0.8-1.3.1.x86_64",
                           product_id: "redis-6.0.8-1.3.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Server Applications 15 SP2",
                        product: {
                           name: "SUSE Linux Enterprise Module for Server Applications 15 SP2",
                           product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP2",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-server-applications:15:sp2",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-6.0.8-1.3.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
            },
            product_reference: "redis-6.0.8-1.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-6.0.8-1.3.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
            },
            product_reference: "redis-6.0.8-1.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-6.0.8-1.3.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
            },
            product_reference: "redis-6.0.8-1.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "redis-6.0.8-1.3.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
            },
            product_reference: "redis-6.0.8-1.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP2",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2013-7458",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2013-7458",
            },
         ],
         notes: [
            {
               category: "general",
               text: "linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2013-7458",
               url: "https://www.suse.com/security/cve/CVE-2013-7458",
            },
            {
               category: "external",
               summary: "SUSE Bug 991250 for CVE-2013-7458",
               url: "https://bugzilla.suse.com/991250",
            },
            {
               category: "external",
               summary: "SUSE Bug 991387 for CVE-2013-7458",
               url: "https://bugzilla.suse.com/991387",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-11-11T11:26:43Z",
               details: "low",
            },
         ],
         title: "CVE-2013-7458",
      },
      {
         cve: "CVE-2015-8080",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2015-8080",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2015-8080",
               url: "https://www.suse.com/security/cve/CVE-2015-8080",
            },
            {
               category: "external",
               summary: "SUSE Bug 1173018 for CVE-2015-8080",
               url: "https://bugzilla.suse.com/1173018",
            },
            {
               category: "external",
               summary: "SUSE Bug 954199 for CVE-2015-8080",
               url: "https://bugzilla.suse.com/954199",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-11-11T11:26:43Z",
               details: "important",
            },
         ],
         title: "CVE-2015-8080",
      },
      {
         cve: "CVE-2016-10517",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-10517",
            },
         ],
         notes: [
            {
               category: "general",
               text: "networking.c in Redis before 3.2.7 allows \"Cross Protocol Scripting\" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-10517",
               url: "https://www.suse.com/security/cve/CVE-2016-10517",
            },
            {
               category: "external",
               summary: "SUSE Bug 1064980 for CVE-2016-10517",
               url: "https://bugzilla.suse.com/1064980",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-11-11T11:26:43Z",
               details: "important",
            },
         ],
         title: "CVE-2016-10517",
      },
      {
         cve: "CVE-2016-8339",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-8339",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-8339",
               url: "https://www.suse.com/security/cve/CVE-2016-8339",
            },
            {
               category: "external",
               summary: "SUSE Bug 1002351 for CVE-2016-8339",
               url: "https://bugzilla.suse.com/1002351",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-11-11T11:26:43Z",
               details: "critical",
            },
         ],
         title: "CVE-2016-8339",
      },
      {
         cve: "CVE-2017-15047",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-15047",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or possibly have unspecified other impact by leveraging \"limited access to the machine.\"",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-15047",
               url: "https://www.suse.com/security/cve/CVE-2017-15047",
            },
            {
               category: "external",
               summary: "SUSE Bug 1061967 for CVE-2017-15047",
               url: "https://bugzilla.suse.com/1061967",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-11-11T11:26:43Z",
               details: "critical",
            },
         ],
         title: "CVE-2017-15047",
      },
      {
         cve: "CVE-2018-11218",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-11218",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-11218",
               url: "https://www.suse.com/security/cve/CVE-2018-11218",
            },
            {
               category: "external",
               summary: "SUSE Bug 1097430 for CVE-2018-11218",
               url: "https://bugzilla.suse.com/1097430",
            },
            {
               category: "external",
               summary: "SUSE Bug 1097768 for CVE-2018-11218",
               url: "https://bugzilla.suse.com/1097768",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-11-11T11:26:43Z",
               details: "critical",
            },
         ],
         title: "CVE-2018-11218",
      },
      {
         cve: "CVE-2018-11219",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-11219",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-11219",
               url: "https://www.suse.com/security/cve/CVE-2018-11219",
            },
            {
               category: "external",
               summary: "SUSE Bug 1097430 for CVE-2018-11219",
               url: "https://bugzilla.suse.com/1097430",
            },
            {
               category: "external",
               summary: "SUSE Bug 1097768 for CVE-2018-11219",
               url: "https://bugzilla.suse.com/1097768",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP2:redis-6.0.8-1.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-11-11T11:26:43Z",
               details: "critical",
            },
         ],
         title: "CVE-2018-11219",
      },
   ],
}