From c87ddd6ee471d8b3a26a684712a4529ec5755e04 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 7 Jul 2025 10:10:50 +0200 Subject: [PATCH] package/redis: security bump to v8.0.3 For release note, see: https://github.com/redis/redis/releases/tag/8.0.3 This fixes the following vulnerabilities: - CVE-2025-32023: An authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43 - CVE-2025-48367: An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq Signed-off-by: Titouan Christophe [Julien: add link to release note] Signed-off-by: Julien Olivain --- package/redis/redis.hash | 2 +- package/redis/redis.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/redis/redis.hash b/package/redis/redis.hash index 4dfe1543d4..c66223f2da 100644 --- a/package/redis/redis.hash +++ b/package/redis/redis.hash @@ -1,5 +1,5 @@ # From https://github.com/redis/redis-hashes/blob/master/README -sha256 e9296b67b54c91befbcca046d67071c780a1f7c9f9e1ae5ed94773c3bb9b542f redis-8.0.2.tar.gz +sha256 33f37290b00b14e9a884dd4dcba335febd63ea16c51609d34fa41e031ad587df redis-8.0.3.tar.gz # Locally calculated sha256 4a0e416b9537688f30dfe69ddaceb2ca64d96b7df02a0a6760d376890ddc4e40 LICENSE.txt diff --git a/package/redis/redis.mk b/package/redis/redis.mk index a4b6b4d652..5ffb2a929f 100644 --- a/package/redis/redis.mk +++ b/package/redis/redis.mk @@ -4,7 +4,7 @@ # ################################################################################ -REDIS_VERSION = 8.0.2 +REDIS_VERSION = 8.0.3 REDIS_SITE = http://download.redis.io/releases REDIS_LICENSE = \ AGPL-3.0 or SSPL-1.0 or RSAL-2.0 (core); \