Depended hiredis v0.12 has security risk, whether newer versions without security risks can be supported?

[blackholll]

from blackduck , we know hiredis 0.12 has security risk. but now the lastest mod_auth_openidc only support hiredis 0.12

[zandbelt]

hiredis is merely a (optional) dependency for mod_auth_openidc; it is up to the OS distribution to patch it or upgrade it

[blackholll]

I tried install mod_auth_openidc on amzn2 or amzn2023, they all need hiredis. I think redis is use for store session, since we are use client-cookie. it there any way to install mod_auth_openidc without hiredis?

[zandbelt]

there's no pre-bulit package for that, you'd have to build the binaries from source yourself

[blackholll]

you mean rpm for amzn? I can build rpm for amzn or install by source code directly, but when I try to install mod_auth_openidc, it says need hiredis 0.12.

but hiredis 0.12 has security risk issue， In our company, we are now allowed install package which has security risk issue.

[blackholll]

I rebuild the rpm package, and it works.
this is the spec for rpm building: https://src.fedoraproject.org/rpms/mod_auth_openidc/blob/rawhide/f/mod_auth_openidc.spec