STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

When updates are applied to Redis Enterprise DBMS software, any software components that have been replaced or made unnecessary must be removed.

DISA Rule

SV-251252r961677_rule

Vulnerability Number

V-251252

Group Title

SRG-APP-000454-DB-000389

Rule Version

RD6X-00-012400

Severity

CAT III

CCI(s)

• CCI-002617 - Remove previous versions of organization-defined software components after updated versions have been installed.

Weight

10

Fix Recommendation

When a new update is available and installed, all old install files must be removed from the locations below:
/opt/redislabs - Main Installation directory for all Redis Enterprise Software binaries
/opt/redislabs/config - System configuration files
/opt/redislabs/lib - System library files
/var/opt/redislabs - Default storage location for the cluster data, system logs, backups and ephemeral, persisted data
/tmp - Temporary files

The GREP command can be used to search for old Redis files in the above locations.

If software from a previous/outdated version of Redis Enterprise remains in any of the following locations/directories, run the following to remove it:
rm -r <file_name>

Check Contents

When the Redis software is upgraded to a new version, the old version install file remains on the server. The users must remove this manually. To verify if the old install files have been deleted, check the locations below:
/opt/redislabs - Main Installation directory for all Redis Enterprise Software binaries
/opt/redislabs/config - System configuration files
/opt/redislabs/lib - System library files
/var/opt/redislabs - Default storage location for the cluster data, system logs, backups and ephemeral, persisted data
/tmp - Temporary files

The GREP command can be used to search for old Redis files in the above locations.

If software components that have been replaced or made unnecessary are not removed, this is a finding.

Vulnerability Number

V-251252

Documentable

False

Rule Version

RD6X-00-012400

Severity Override Guidance

When the Redis software is upgraded to a new version, the old version install file remains on the server. The users must remove this manually. To verify if the old install files have been deleted, check the locations below:
/opt/redislabs - Main Installation directory for all Redis Enterprise Software binaries
/opt/redislabs/config - System configuration files
/opt/redislabs/lib - System library files
/var/opt/redislabs - Default storage location for the cluster data, system logs, backups and ephemeral, persisted data
/tmp - Temporary files

The GREP command can be used to search for old Redis files in the above locations.

If software components that have been replaced or made unnecessary are not removed, this is a finding.

Check Content Reference

M

Target Key

5443