libhiredis0.14, httpd, libcjose0 libapache2-mod-auth-openidc

[fong1999]

Hi! I am reaching out is to ask if you have any other versions of libhiredis that we can use.

We are having CVE with our httpd base image. When we upgrade to the latest version of httpd image, the CVE is disappeared. However, our app will not start. The error we are getting is related to redis. From the list that we can find, libhiredis0.14 (0.14.1-4) is the only version we can see. So we had to use the earlier version - httpd:2.4.56-debian-ff which work with libhiredis0.14.

Here is what we have currently:

apt install -y libcjose0 libapache2-mod-auth-openidc libhiredis0.14

Below is what we get:

❯ apt-cache show libapache2-mod-auth-openidc|grep Depends
Depends: libapr1 (>= 1.2.7), libaprutil1 (>= 1.4.0), libc6 (>= 2.14), libcjose0 (>= 0.4.1), libcurl4 (>= 7.16.2), libhiredis0.14 (>= 0.14.0), libjansson4 (>= 2.0.1), libpcre3, libssl3 (>= 3.0.0~~alpha1), apache2-api-20120211, apache2-bin (>= 2.4.16)

It specifically wants hiredis v0.14.0. We tried to use different version of httpd base image other than httpd:2.4.56-debian-ff. But we have not found one that works yet. In order to fix the CVE, we need to be able to find a newer version of libapache2-mod-auth-openidc that works with newer version of libhiredis.

I submitted a question with hiredis github repo. They do have newer version of libhiredis. I am looking for assistance from you to find out what version of httpd and libapache2-mod-auth-openidc will work with libhiredis. Any suggestions? Thanks in advance!

Thanks,
Fong