From bd47e35e57de58d8fc0faac42167a531d7c29242 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 13 Oct 2025 17:43:49 +0200 Subject: [PATCH] package/redis: security bump to v8.2.2 See the release notes: https://github.com/redis/redis/blob/8.2.2/00-RELEASENOTES This fixes the following vulnerabilities (in the Lua scripting engine): - CVE-2025-46817: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. https://www.cve.org/CVERecord?id=CVE-2025-46817 - CVE-2025-46818: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families. https://www.cve.org/CVERecord?id=CVE-2025-46818 - CVE-2025-46819: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families. https://www.cve.org/CVERecord?id=CVE-2025-46819 - CVE-2025-49844: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. https://www.cve.org/CVERecord?id=CVE-2025-49844 Signed-off-by: Titouan Christophe Signed-off-by: Julien Olivain --- package/redis/redis.hash | 2 +- package/redis/redis.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/redis/redis.hash b/package/redis/redis.hash index 74fadfa8c0..beda6bc48c 100644 --- a/package/redis/redis.hash +++ b/package/redis/redis.hash @@ -1,5 +1,5 @@ # From https://github.com/redis/redis-hashes/blob/master/README -sha256 e2c1cb9dd4180a35b943b85dfc7dcdd42566cdbceca37d0d0b14c21731582d3e redis-8.2.1.tar.gz +sha256 4e340e8e822a82114b6fb0f7ca581b749fa876e31e36e9fbcb75416bec9d0608 redis-8.2.2.tar.gz # Locally calculated sha256 4a0e416b9537688f30dfe69ddaceb2ca64d96b7df02a0a6760d376890ddc4e40 LICENSE.txt diff --git a/package/redis/redis.mk b/package/redis/redis.mk index f2d7d43b7a..fbad637aff 100644 --- a/package/redis/redis.mk +++ b/package/redis/redis.mk @@ -4,7 +4,7 @@ # ################################################################################ -REDIS_VERSION = 8.2.1 +REDIS_VERSION = 8.2.2 REDIS_SITE = http://download.redis.io/releases REDIS_LICENSE = \ AGPL-3.0 or SSPL-1.0 or RSAL-2.0 (core); \