From 7481c699144a2080279922af4c4ccade7c21bbc8 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Sat, 1 Feb 2025 17:29:54 +0100 Subject: [PATCH] package/redis: security bump to version 7.2.7 Fixes the following security issues: 7.2.6: - (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE - (CVE-2024-31227) Potential Denial-of-service due to malformed ACL selectors - (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching 7.2.7: - (CVE-2024-46981) Lua script commands may lead to remote code execution - (CVE-2024-51741) Denial-of-service due to malformed ACL selectors https://github.com/redis/redis/releases/tag/7.2.6 https://github.com/redis/redis/releases/tag/7.2.7 Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain (cherry picked from commit f3e99436eec2b5a096ac94c18b9a835806ee9de3) Signed-off-by: Peter Korsgaard --- package/redis/redis.hash | 2 +- package/redis/redis.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/redis/redis.hash b/package/redis/redis.hash index 5c3a5ea4d8..e01fc6a601 100644 --- a/package/redis/redis.hash +++ b/package/redis/redis.hash @@ -1,5 +1,5 @@ # From https://github.com/redis/redis-hashes/blob/master/README -sha256 5981179706f8391f03be91d951acafaeda91af7fac56beffb2701963103e423d redis-7.2.5.tar.gz +sha256 72c081e3b8cfae7144273d26d76736f08319000af46c01515cad5d29765cead5 redis-7.2.7.tar.gz # Locally calculated sha256 97f0a15b7bbae580d2609dad2e11f1956ae167be296ab60f4691ab9c30ee9828 COPYING diff --git a/package/redis/redis.mk b/package/redis/redis.mk index 852bf31ca0..7eb30abc4c 100644 --- a/package/redis/redis.mk +++ b/package/redis/redis.mk @@ -4,7 +4,7 @@ # ################################################################################ -REDIS_VERSION = 7.2.5 +REDIS_VERSION = 7.2.7 REDIS_SITE = http://download.redis.io/releases REDIS_LICENSE = BSD-3-Clause (core); MIT and BSD family licenses (Bundled components) REDIS_LICENSE_FILES = COPYING