mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-08 23:51:08 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/redis: security bump to v7.2.14

Browse Source 
See the release notes:
https://github.com/redis/redis/blob/7.2.14/00-RELEASENOTES

This fixes the following vulnerabilites:
- CVE-2026-23479:
    Redis is an in-memory data structure store. In redis-server from 7.2.0
    until 8.6.3, the unblock client flow does not handle an error return
    from `processCommandAndResetClient` when re-executing a blocked
    command. If a blocked client is evicted during this flow, an
    authenticated attacker can trigger a use-after-free that may lead to
    remote code execution. This has been patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-23479

- CVE-2026-23631:
    Redis is an in-memory data structure store. In all versions of redis-
    server with Lua scripting, an authenticated attacker can exploit the
    master-replica synchronization mechanism to trigger a use-after-free
    on replicas where replica-read-only is disabled or can be disabled,
    which may lead to remote code execution. A workaround is to prevent
    users from executing Lua scripts or avoid using replicas where
    replica-read-only is disabled. This is patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-23631

- CVE-2026-25243:
    Redis is an in-memory data structure store. In versions of redis-
    server up to 8.6.3, the RESTORE command does not properly validate
    serialized values. An authenticated attacker with permission to
    execute RESTORE can supply a crafted serialized payload that triggers
    invalid memory access and may lead to remote code execution. A
    workaround is to restrict access to the RESTORE command with ACL
    rules. This is patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-25243

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit be7b7821c6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-06-09 00:38:10 +02:00
committed by Thomas Perale
parent c49ae72167
commit ef4ba987c5
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/redis/redis.hash
View File

@@ -1,5 +1,5 @@
# From https://github.com/redis/redis-hashes/blob/master/README
sha256 b3eeef15ea90a41c568f1f97a78d3370400baad55566869bbbf1af9f9106d85c redis-7.2.13.tar.gz
sha256 21326da3f66c0aead4c8204c0ac52ff905337a77cadd169f75ac22835ea30025 redis-7.2.14.tar.gz
# Locally calculated
sha256 97f0a15b7bbae580d2609dad2e11f1956ae167be296ab60f4691ab9c30ee9828 COPYING

2
package/redis/redis.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
REDIS_VERSION = 7.2.13
REDIS_VERSION = 7.2.14
REDIS_SITE = http://download.redis.io/releases
REDIS_LICENSE = BSD-3-Clause (core); MIT and BSD family licenses (Bundled components)
REDIS_LICENSE_FILES = COPYING