CVE-2016-2121 Information disclosure in redis

Medium 4.0 Published 31 Oct 2018 Updated 5 Aug 2024

A local unprivileged user can access sensitive system information due to weak file permissions in Redis.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2016-2121?

CVE-2016-2121 is a medium-severity vulnerability in Redhat Openstack, published on 31 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information.

Weakness: CWE-264, CWE-732

Which versions are affected by CVE-2016-2121?

It affects 1 product.

Linux distribution packages (2)

`redis` Red Hat:openstack:10::el7	All versions	`0:3.0.6-2.el7ost`
`redis-debuginfo` Red Hat:openstack:10::el7	All versions	`0:3.0.6-2.el7ost`

Products include Redhat Openstack.

How do I fix CVE-2016-2121?

Apply the vendor's patch.

Is CVE-2016-2121 being exploited?

There is no known exploitation of CVE-2016-2121 in the wild and no public exploit code.

All Redhat Openstack vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-2121, GHSA-6837-f96c-5j64, RHSA-2017:3226, UBUNTU-CVE-2016-2121.