redis漏洞修复：CVE-2022-35977、CVE-2023-22458、CVE-2023-28856

提示：文章写完后，目录可以自动生成，如何生成可参考右边的帮助文档

---

前言

漏扫发现机器上的redis版本有点低，需要升级版本修复漏洞

---

一、漏洞内容

Redis Labs Redis 输入验证错误漏洞(CVE-2022-35951)

Redis 输入验证错误漏洞（CVE-2023-22458）

Redis 安全漏洞(CVE-2023-28856)

二、现状

现在的redis是使用的docker运行的，版本是7.0.4

docker exec -it redis /bin/bash
root@9c719615bb29:/data# redis-cli  -v
redis-cli 7.0.4
1
2
3

三、更新redis

下载镜像

docker pull redis:latest
1

停止已有的容器

docker stop   redis
docker rm    redis
1
2

启动新的容器

docker run --name redis -d -p 6379:6379  -v /data/redis-data:/data --restart=always   redis:latest
1

四、更新后的版本

1. 查看日志

docker logs redis
1:C 20 Sep 2023 02:28:11.118 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
1:C 20 Sep 2023 02:28:11.118 * Redis version=7.2.1, bits=64, commit=00000000, modified=0, pid=1, just started
1:C 20 Sep 2023 02:28:11.118 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf
1:M 20 Sep 2023 02:28:11.119 * monotonic clock: POSIX clock_gettime
1:M 20 Sep 2023 02:28:11.121 * Running mode=standalone, port=6379.
1:M 20 Sep 2023 02:28:11.121 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128.
1:M 20 Sep 2023 02:28:11.123 * Server initialized
1:M 20 Sep 2023 02:28:11.123 * Loading RDB produced by version 7.0.4
1:M 20 Sep 2023 02:28:11.123 * RDB age 84 seconds
1:M 20 Sep 2023 02:28:11.123 * RDB memory usage when created 1.00 Mb
1:M 20 Sep 2023 02:28:11.124 * Done loading RDB, keys loaded: 1, keys expired: 90.
1:M 20 Sep 2023 02:28:11.124 * DB loaded from disk: 0.000 seconds
1:M 20 Sep 2023 02:28:11.124 * Ready to accept connections tcp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

2. 查看版本

redis-cli -v
redis-cli 7.2.1
1
2

---

总结

我之前的redis部署把data目录挂载出来了，所以升级比较简单