Description

Cloudron common redis image is vulnerable to critical vulnerability (CVE-2025-49844 - 10 CVSS)

Logs

Logs says it's version 7.4.2, fixed version is 7.4.6

Gitlab

Oct 08 12:06:24 13:C 08 Oct 2025 10:06:24.722 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
Oct 08 12:06:24 13:C 08 Oct 2025 10:06:24.722 * Redis version=7.4.2, bits=64, commit=00000000, modified=0, pid=13, just started
Oct 08 12:06:24 13:C 08 Oct 2025 10:06:24.722 * Configuration loaded
Oct 08 12:06:24 13:M 08 Oct 2025 10:06:24.722 * monotonic clock: POSIX clock_gettime
Oct 08 12:06:24 13:M 08 Oct 2025 10:06:24.724 # Failed to write PID file: Permission denied
Oct 08 12:06:24 13:M 08 Oct 2025 10:06:24.724 * Running mode=standalone, port=6379.
Oct 08 12:06:24 13:M 08 Oct 2025 10:06:24.725 * Server initialized
Oct 08 12:06:24 13:M 08 Oct 2025 10:06:24.725 * Loading RDB produced by version 7.4.2

Same with N8n:

Oct 08 12:19:46 13:C 08 Oct 2025 10:19:46.483 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
Oct 08 12:19:46 13:C 08 Oct 2025 10:19:46.483 * Redis version=7.4.2, bits=64, commit=00000000, modified=0, pid=13, just started
Oct 08 12:19:46 13:C 08 Oct 2025 10:19:46.483 * Configuration loaded
Oct 08 12:19:46 13:M 08 Oct 2025 10:19:46.483 * monotonic clock: POSIX clock_gettime
Oct 08 12:19:46 13:M 08 Oct 2025 10:19:46.485 # Failed to write PID file: Permission denied
Oct 08 12:19:46 13:M 08 Oct 2025 10:19:46.485 * Running mode=standalone, port=6379.
Oct 08 12:19:46 13:M 08 Oct 2025 10:19:46.485 * Server initialized
Oct 08 12:19:46 13:M 08 Oct 2025 10:19:46.486 * Loading RDB produced by version 7.4.2

And all other apps using redis, probably the same redis image is used

System Details

Cloudron Version

{
  "version": "8.3.2"
}

Ubuntu Version

No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 24.04.2 LTS
Release:	24.04
Codename:	noble

Cloudron installation method

Manual with ./cloudron-setup

Hi,

An automatic upgrade happened this night on our server and all DNS queries result in empty response from systemd-resolved.

Here a part of the box.log where we saw the first error:

2024-08-10T01:33:35.165Z box:apphealthmonitor app health: 24 running / 2 stopped / 0 unresponsive
2024-08-10T01:33:36.851Z box:box Received SIGTERM. Shutting down.
2024-08-10T01:33:36.858Z box:platform uninitializing platform
2024-08-10T01:33:36.859Z box:shell startTask: /usr/bin/sudo -S -E /home/yellowtent/box/src/scripts/starttask.sh 12905 /home/yellowtent/platformdata/logs/tasks/12905.log 15 1024 errored BoxError: startTask exited with code null signal SIGTERM
    at ChildProcess.<anonymous> (/home/yellowtent/box/src/shell.js:110:19)
    at ChildProcess.emit (node:events:513:28)
    at ChildProcess._handle.onexit (node:internal/child_process:291:12) {
  reason: 'Shell Error',
  details: {},
  code: null,
  signal: 'SIGTERM'
}
2024-08-10T01:33:36.934Z box:tasks startTask: 12905 completed with code null
2024-08-10T01:33:36.937Z box:tasks setCompleted - 12905: {"error":{"message":"Task 12905 crashed with code null","code":"crashed"}}
2024-08-10T01:33:36.937Z box:tasks update 12905: {"percent":100,"error":{"message":"Task 12905 crashed with code null","code":"crashed"}}
2024-08-10T01:33:36.938Z box:platform onDeactivated: stopping post activation services
2024-08-10T01:33:36.939Z box:tasks stopAllTasks: stopping all tasks
2024-08-10T01:33:36.940Z box:shell stopTask /usr/bin/sudo -S /home/yellowtent/box/src/scripts/stoptask.sh all
2024-08-10T01:33:36.952Z box:locker Released : box_update
2024-08-10T01:33:36.952Z box:updater Update failed with error. { message: 'Task 12905 crashed with code null', code: 'crashed' }
2024-08-10T01:33:36.953Z box:tasks startTask: 12905 done. error: { message: 'Task 12905 crashed with code null', code: 'crashed' }
2024-08-10T01:35:10.561Z box:server ==========================================
2024-08-10T01:35:10.562Z box:server            Cloudron 8.0.3  
2024-08-10T01:35:10.562Z box:server ==========================================
2024-08-10T01:35:10.562Z box:platform initialize: start platform
2024-08-10T01:35:10.902Z box:tasks stopAllTasks: stopping all tasks
2024-08-10T01:35:10.902Z box:shell stopTask /usr/bin/sudo -S /home/yellowtent/box/src/scripts/stoptask.sh all
sudo: unable to resolve host my: Temporary failure in name resolution
All tasks stopped
2024-08-10T01:35:11.141Z box:reverseproxy writeDashboardConfig: writing dashboard config for a38.fr
2024-08-10T01:35:11.158Z box:shell isOscpEnabled execArgs: openssl ["x509","-in","/home/yellowtent/platformdata/nginx/cert/_.a38.fr.cert","-noout","-ocsp_uri"]
2024-08-10T01:35:11.179Z box:shell reload /usr/bin/sudo -S /home/yellowtent/box/src/scripts/restartservice.sh nginx
sudo: unable to resolve host my: Temporary failure in name resolution
nginx: [warn] "ssl_stapling" ignored, host not found in OCSP responder "e5.o.lencr.org" in the certificate "/home/yellowtent/platformdata/nginx/cert/_.a38.fr.cert"
nginx: [warn] "ssl_stapling" ignored, host not found in OCSP responder "e5.o.lencr.org" in the certificate "/home/yellowtent/platformdata/nginx/cert/a38.fr.cert"
nginx: [warn] "ssl_stapling" ignored, host not found in OCSP responder "e5.o.lencr.org" in the certificate "/home/yellowtent/platformdata/nginx/cert/_.a38.fr.cert"
nginx: [warn] "ssl_stapling" ignored, host not found in OCSP responder "e5.o.lencr.org" in the certificate "/home/yellowtent/platformdata/nginx/cert/_.a38.fr.cert"

dig response:

$ dig api.cloudron.io

; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> api.cloudron.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12668
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;api.cloudron.io.		IN	A

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Sat Aug 10 15:56:07 UTC 2024
;; MSG SIZE  rcvd: 44

All apps were in error state and i successfully started them all with write api.cloudron.io in host file and retry configure task in cloudron panel.

Unfortunately, this is only temporary fix as dns issue is still there and app store for example is still unavailable (so i commented out this fix).