mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-01 21:23:51 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/redis: security bump to v8.6.4

Browse Source 
See the release notes:
https://github.com/redis/redis/blob/8.6.4/00-RELEASENOTES

This fixes the following vulnerabilities:
- CVE-2026-23479:
    Redis is an in-memory data structure store. In redis-server from 7.2.0
    until 8.6.3, the unblock client flow does not handle an error return
    from `processCommandAndResetClient` when re-executing a blocked
    command. If a blocked client is evicted during this flow, an
    authenticated attacker can trigger a use-after-free that may lead to
    remote code execution. This has been patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-23479

- CVE-2026-23631:
    Redis is an in-memory data structure store. In all versions of redis-
    server with Lua scripting, an authenticated attacker can exploit the
    master-replica synchronization mechanism to trigger a use-after-free
    on replicas where replica-read-only is disabled or can be disabled,
    which may lead to remote code execution. A workaround is to prevent
    users from executing Lua scripts or avoid using replicas where
    replica-read-only is disabled. This is patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-23631

- CVE-2026-25243:
    Redis is an in-memory data structure store. In versions of redis-
    server up to 8.6.3, the RESTORE command does not properly validate
    serialized values. An authenticated attacker with permission to
    execute RESTORE can supply a crafted serialized payload that triggers
    invalid memory access and may lead to remote code execution. A
    workaround is to restrict access to the RESTORE command with ACL
    rules. This is patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-25243

- CVE-2026-25588:
    RedisTimeSeries is a time-series module for Redis. In all versions
    before 1.12.14 of RedisTimeSeries, the module does not properly
    validate serialized values processed through the Redis RESTORE
    command. An authenticated attacker with permission to execute RESTORE
    on a server with the RedisTimeSeries module loaded can supply a
    crafted serialized payload that triggers invalid memory access and may
    lead to remote code execution. A workaround is to restrict access to
    the RESTORE command with ACL rules. This has been patched in version
    1.12.14.
    https://www.cve.org/CVERecord?id=CVE-2026-25588

- CVE-2026-25589:
    RedisBloom is a probabilistic data structures module for Redis. In all
    versions of RedisBloom before 2.8.20, the module does not properly
    validate serialized values processed through the Redis RESTORE
    command. An authenticated attacker with permission to execute RESTORE
    on a server with the RedisBloom module loaded can supply a crafted
    serialized payload that triggers invalid memory access and may lead to
    remote code execution. A workaround is to restrict access to the
    RESTORE command with ACL rules. This issue is fixed in version 2.8.20.
    https://www.cve.org/CVERecord?id=CVE-2026-25589

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Titouan Christophe
2026-06-09 00:26:01 +02:00
committed by Peter Korsgaard
parent c7f2991ac3
commit be7b7821c6
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/redis/redis.hash
View File

@@ -1,5 +1,5 @@
# From https://github.com/redis/redis-hashes/blob/master/README
sha256 cea46526594fe05f05b9ff733179eb1263deccf4269059cf081fdef222634c88 redis-8.6.2.tar.gz
sha256 559c2e50c496b2d4afcfb491af27763a1b170037317789ecf309025d0caece24 redis-8.6.4.tar.gz
# Locally calculated
sha256 4a0e416b9537688f30dfe69ddaceb2ca64d96b7df02a0a6760d376890ddc4e40 LICENSE.txt

2
package/redis/redis.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
REDIS_VERSION = 8.6.2
REDIS_VERSION = 8.6.4
REDIS_SITE = http://download.redis.io/releases
REDIS_LICENSE = \
AGPL-3.0 or SSPL-1.0 or RSAL-2.0 (core); \