From bdd3382ea55a5871600c5315d709a1d90bcc3b24 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 7 Jul 2025 10:11:13 +0200 Subject: [PATCH] package/redis: security bump to v7.2.10 This fixes the following vulnerabilities: - CVE-2025-32023: An authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43 - CVE-2025-48367: An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq Signed-off-by: Titouan Christophe (cherry picked from commit c87ddd6ee471d8b3a26a684712a4529ec5755e04) Signed-off-by: Thomas Perale --- package/redis/redis.hash | 2 +- package/redis/redis.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/redis/redis.hash b/package/redis/redis.hash index 158931bb89..630f6b6d76 100644 --- a/package/redis/redis.hash +++ b/package/redis/redis.hash @@ -1,5 +1,5 @@ # From https://github.com/redis/redis-hashes/blob/master/README -sha256 2343cc49db3beb9d2925a44e13032805a608821a58f25bd874c84881115a20b7 redis-7.2.9.tar.gz +sha256 e576ad54bc53770649c556933ecd555b975e3dac422e46356102436a437b43c7 redis-7.2.10.tar.gz # Locally calculated sha256 97f0a15b7bbae580d2609dad2e11f1956ae167be296ab60f4691ab9c30ee9828 COPYING diff --git a/package/redis/redis.mk b/package/redis/redis.mk index 7c847690a9..a2d4fbe138 100644 --- a/package/redis/redis.mk +++ b/package/redis/redis.mk @@ -4,7 +4,7 @@ # ################################################################################ -REDIS_VERSION = 7.2.9 +REDIS_VERSION = 7.2.10 REDIS_SITE = http://download.redis.io/releases REDIS_LICENSE = BSD-3-Clause (core); MIT and BSD family licenses (Bundled components) REDIS_LICENSE_FILES = COPYING