From ef4ba987c5c24e8bcbb50d499cabdcf7511f74c3 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Tue, 9 Jun 2026 00:38:10 +0200 Subject: [PATCH] package/redis: security bump to v7.2.14 See the release notes: https://github.com/redis/redis/blob/7.2.14/00-RELEASENOTES This fixes the following vulnerabilites: - CVE-2026-23479: Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3. https://www.cve.org/CVERecord?id=CVE-2026-23479 - CVE-2026-23631: Redis is an in-memory data structure store. In all versions of redis- server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3. https://www.cve.org/CVERecord?id=CVE-2026-23631 - CVE-2026-25243: Redis is an in-memory data structure store. In versions of redis- server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3. https://www.cve.org/CVERecord?id=CVE-2026-25243 Signed-off-by: Titouan Christophe (cherry picked from commit be7b7821c665db35beea8763c50a49da76bef1f5) Signed-off-by: Thomas Perale --- package/redis/redis.hash | 2 +- package/redis/redis.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/redis/redis.hash b/package/redis/redis.hash index 9e5be53969..055276a270 100644 --- a/package/redis/redis.hash +++ b/package/redis/redis.hash @@ -1,5 +1,5 @@ # From https://github.com/redis/redis-hashes/blob/master/README -sha256 b3eeef15ea90a41c568f1f97a78d3370400baad55566869bbbf1af9f9106d85c redis-7.2.13.tar.gz +sha256 21326da3f66c0aead4c8204c0ac52ff905337a77cadd169f75ac22835ea30025 redis-7.2.14.tar.gz # Locally calculated sha256 97f0a15b7bbae580d2609dad2e11f1956ae167be296ab60f4691ab9c30ee9828 COPYING diff --git a/package/redis/redis.mk b/package/redis/redis.mk index b9702eb6e0..62f70b352b 100644 --- a/package/redis/redis.mk +++ b/package/redis/redis.mk @@ -4,7 +4,7 @@ # ################################################################################ -REDIS_VERSION = 7.2.13 +REDIS_VERSION = 7.2.14 REDIS_SITE = http://download.redis.io/releases REDIS_LICENSE = BSD-3-Clause (core); MIT and BSD family licenses (Bundled components) REDIS_LICENSE_FILES = COPYING