Redis Support for Yara Distributed Mode in EDR Server 7.9.0

Products

Carbon Black EDR

Issue/Introduction

Carbon Black EDR Server 7.9.0 disables the Redis EVAL and EVALSHA commands as a security precaution for CVE-2025-49844 and affects the Carbon Black EDR YARA Connector in distributed mode.

Environment

Carbon Black EDR Server: Supported Versions
Carbon Black EDR Yara Connector: 2.2.1

Cause

The Carbon Black EDR YARA Connector, when set up in distributed mode, uses the Redis EVAL and EVALSHA commands through its internal messaging library (Celery/kombu). When these commands are disabled, the connector cannot communicate with Redis and may fail during scan processing.

Resolution

Choose one of the following approaches to resolve the issue:

Option A: Re-enable the Redis commands after upgrading to Carbon Black EDR Server 7.9.1 or later.
Option B: Configure RabbitMQ as the YARA Connector message broker if Redis command restrictions must remain in place.

Option A: Re-enable Redis Commands
1. Confirm your Redis version
  1. Run the following command on the primary server:
```
rpm -qa | grep redis
```
    The output must show version 7.2.11 or newer before you continue. If it is older, upgrade Carbon Black EDR Server to 7.9.1 or higher by following appropriate documentation or use Option B.
2. Re-enable commands in the Redis config
  1. On all EDR Server nodes, open the configuration file:
```
vi /etc/cb/redis.conf.template
```
  2. Find these two lines and comment them out by adding a # at the start:
```
rename-command EVAL ""
rename-command EVALSHA ""
```
3. Restart EDR Server services
4. Confirm Redis connectivity
  1. Run cmd from the minion server (replace with your primary server's IP):
```
nc -zv <primary-server-ip> 6379
```
  2. If succeeded, proceed to Step 6
  3. If failed, refused, or timed out, continue to Step 5.
5. Open the Redis firewall port
  1. If connectivity failed, run the following on the primary server to open the port globally, or restrict the firewall rule specifically to the IP address of the minion node:
```
sudo firewall-cmd --permanent --add-port=6379/tcp
sudo firewall-cmd --reload
```
6. Set the broker URL
  1. On both the primary and minion servers, edit:
```
vi /etc/cb/integrations/cb-yara-connector/yaraconnector.conf
```
  2. Set the broker_url to point at the primary server's Redis instance:
```
broker_url=redis://<primary-server-ip>:6379
```
7. Restart the YARA Connector
  1. Run on both servers:
```
sudo systemctl restart cb-yara-connector
```
Optionn B: Switch to RabbitMQ
RabbitMQ is already installed on the CB EDR server; no additional software installation is required.
1. Create a RabbitMQ account
  1. Run these commands on the RabbitMQ server, replacing <PASSWORD> with a strong password:
```
sudo /usr/share/cb/cbrabbitmqctl add_vhost yara
sudo /usr/share/cb/cbrabbitmqctl add_user yara '<PASSWORD>'
sudo /usr/share/cb/cbrabbitmqctl set_permissions -p yara yara ".*" ".*" ".*"
```
2. Update the connector configuration
  1. On both the primary and minion servers, update yaraconnector.conf:
```
broker_url=amqp://yara:<PASSWORD>@<primary-server-ip>:<PORT>/yara
results_backend=rpc://
```
3. Restart and Verify
  1. Restart the service on both servers:
```
sudo systemctl restart cb-yara-connector
```
4. Monitor the logs to ensure tasks are being received:
```
tail -f /var/log/cb/integrations/cb-yara-connector/yaraconnector.log
```

Additional Information

Carbon Black EDR Server 7.9.1 upgrades Redis to version 7.2.11, which includes the fix for CVE-2025-49844.
After upgrading to Carbon Black EDR Server 7.9.1 or later, re-enabling the EVAL and EVALSHA commands is safe.