Resolved via podman exec romm-redis redis-server --version → 7.4.11 on library/redis:7-alpine
(Alpine 3.21.7 base) — a rolling tag, so the build can move under the service. The only patched-and-shipped
row, CVE-2025-49844 (critical, fixed 7.4.6), is already covered.
Exposure is container-network only (romm's backend), no published port.
Action: pin library/redis:7.4.x@sha256:… instead of :7-alpine so a vendor fix can be adopted
deliberately, then bump when Redis publishes the fixes; nothing to install today.
**Severity:** 6 high + 5 medium; the vendor's own fix column reads `TBD` for every row except one.
| CVE | Severity | Vendor fix |
|---|---|---|
| [CVE-2026-23479](https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3) | high | TBD |
| [CVE-2026-25243](https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4) | high | TBD |
| [CVE-2025-46817](https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp) | high | TBD |
| [CVE-2025-48367](https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq) | high | TBD |
| [CVE-2025-32023](https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43) | high | TBD |
| [CVE-2025-21605](https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff) | high | TBD |
| [GHSA-2r7g-8hpc-rpq9](https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9) | high | none |
| CVE-2026-23631, CVE-2024-51741, CVE-2025-27151, CVE-2025-46818, CVE-2025-46819 | medium | TBD |
Resolved via `podman exec romm-redis redis-server --version` → 7.4.11 on `library/redis:7-alpine`
(Alpine 3.21.7 base) — a rolling tag, so the build can move under the service. The only patched-and-shipped
row, [CVE-2025-49844](https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q) (critical, fixed 7.4.6), is already covered.
Exposure is container-network only (romm's backend), no published port.
**Action:** pin `library/redis:7.4.x@sha256:…` instead of `:7-alpine` so a vendor fix can be adopted
deliberately, then bump when Redis publishes the fixes; nothing to install today.
Source: [vuln-dankserver.md](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/vuln-dankserver.md) · audit [fleet-security-audit-2026-10-21.html](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/fleet-security-audit-2026-10-21.html)
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
dank
self-assigned this 2026-10-21 15:59:09 -07:00
Taking ownership (agent). Vendor fixes are TBD, so the repo action is pinning romm-redis to the current digest (kills the rolling-tag drift) and recording the accepted-risk note beside the pin.
**Taking ownership (agent).** Vendor fixes are TBD, so the repo action is pinning `romm-redis` to the current digest (kills the rolling-tag drift) and recording the accepted-risk note beside the pin.
Pinned in place (repo PR #74): docker.io/library/redis:7-alpine@sha256:858f009f... on the romm-redis unit - the rolling-tag drift is dead, the audited coordinate is fixed. All six HIGH rows still read vendor TBD, so the residual risk is recorded, not fixable until Redis ships; re-grade on the next scan. Exposure unchanged: romm backend netns only.
Pinned in place (repo PR #74): `docker.io/library/redis:7-alpine@sha256:858f009f...` on the romm-redis unit - the rolling-tag drift is dead, the audited coordinate is fixed. All six HIGH rows still read vendor `TBD`, so the residual risk is **recorded, not fixable** until Redis ships; re-grade on the next scan. Exposure unchanged: romm backend netns only.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: 6 high + 5 medium; the vendor's own fix column reads
TBDfor every row except one.Resolved via
podman exec romm-redis redis-server --version→ 7.4.11 onlibrary/redis:7-alpine(Alpine 3.21.7 base) — a rolling tag, so the build can move under the service. The only patched-and-shipped
row, CVE-2025-49844 (critical, fixed 7.4.6), is already covered.
Exposure is container-network only (romm's backend), no published port.
Action: pin
library/redis:7.4.x@sha256:…instead of:7-alpineso a vendor fix can be adopteddeliberately, then bump when Redis publishes the fixes; nothing to install today.
Source: vuln-dankserver.md · audit fleet-security-audit-2026-10-21.html
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Taking ownership (agent). Vendor fixes are TBD, so the repo action is pinning
romm-redisto the current digest (kills the rolling-tag drift) and recording the accepted-risk note beside the pin.Pinned in place (repo PR #74):
docker.io/library/redis:7-alpine@sha256:858f009f...on the romm-redis unit - the rolling-tag drift is dead, the audited coordinate is fixed. All six HIGH rows still read vendorTBD, so the residual risk is recorded, not fixable until Redis ships; re-grade on the next scan. Exposure unchanged: romm backend netns only.