-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 09 Oct 2024 13:41:44 -0700
Source: redis
Built-For-Profiles: nocheck
Architecture: source
Version: 5:7.0.15-2
Distribution: unstable
Urgency: high
Maintainer: Chris Lamb <lamby@debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Closes: 1084805
Changes:
redis (5:7.0.15-2) unstable; urgency=high
.
* Fix three new security vulnerabilities:
.
- CVE-2024-31227: An authenticated with sufficient privileges could have
created a malformed ACL selector which, when accessed, triggered a server
panic and subsequent denial of service.
.
- CVE-2024-31228: Authenticated users could have triggered a
denial-of-service by using specially crafted, long string match patterns
on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION
LIST`, `COMMAND | LIST` and ACL definitions. Matching of extremely long
patterns may have resulted in unbounded recursion, leading to stack overflow
and process crash.
.
- CVE-2024-31449: An authenticated user may have used a specially crafted
Lua script to trigger a stack buffer overflow in the bit library, which
may have potentially led to remote code execution.
.
(Closes: #1084805)
.
* Correct a link in previous changelog message.
Checksums-Sha1:
9bafb437de37694fad2a2e563ec30f2b2eae96a8 2273 redis_7.0.15-2.dsc
55e8528b1bb915895915e816a9c6a797b1f1c40d 30740 redis_7.0.15-2.debian.tar.xz
012acf34db6ab79a358dbbd974a3e6b79408f83e 7354 redis_7.0.15-2_amd64.buildinfo
Checksums-Sha256:
e39fcc2feb94ee743f901b9ae91b162e1b41d7ee0c54c0c4702cc48d286af673 2273 redis_7.0.15-2.dsc
b72ba287339775d5b99c9e35b7ff3e057c0671e5be584633871ae2a4944b2e6f 30740 redis_7.0.15-2.debian.tar.xz
4951d7d97d8b9c77c31f02cd2c3bb2d1017144fa55d4d6e198ef838e19df94f9 7354 redis_7.0.15-2_amd64.buildinfo
Files:
4a5be94439db51f4cd42cc47723510cd 2273 database optional redis_7.0.15-2.dsc
af1fcc3c760724efe24cce11a4abdd7d 30740 database optional redis_7.0.15-2.debian.tar.xz
faa8b598243c2f338d5d6d1654187f91 7354 database optional redis_7.0.15-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmcG61gACgkQHpU+J9Qx
HliA3g//X0FahxSOikmMYqV4T9Kk+BNnA0wrOv4elAqUnD5UhA9wNkPTFL9np3r/
eI/g3P5Fyu6ZV/4DZ29taIqlJbbdhfBtpELMwNst8I7In/+Mj0/Q2GApmyEBwwSU
Ps1DvUIzYgybk8ZSn8+gXBI2XThg0gGBU/ogjk1tNMGPDBM8jIhQtN5A4ey087Eh
rbMclk0Lo8xWOeq8hxb0/wW4ihSYh8dKFqrvLOIsBj1pgcZmxyrRYN5TAaoYmtNb
KjR22ZWWMYtFGf2XDQm/aOuYWFePkkyXQlGSZUlP5tB1LzYUdYgYSbTYYzcVNbrW
aiMfBcm3dJI18U3ROJBnOe1LkXpttmRCqao1cDJwognBbyQpZRnveXJ8PuQZfhUU
gk2xmqgGAI6mHK5TA+eATozc2L8/bTt5uW4HwTM01XyumsfIxrGdxjr62wUErGmb
74xpOp6Ct6a0preajMC0k/AAarnbD8Oxl5AuuJ3tmK/6WUZPFjTQcx6JRpU1twSH
sIJ4dv+15BQi+/xud1gV4vPkczYTYOLXRHT7EPXrwjH3MSuRBU4SzJn8pXZo37pa
1SaKLrh//T8FhLv1zRTjG7TnbsdqTBOtgYWt5/SLQ3c5gnZhkks8MDA0UXuP5Iiw
RevP363jj5mdz52G04BhikLSYVuVm8Bh0onf3IprxjSRjYl8j4w=
=pFmZ
-----END PGP SIGNATURE-----
Attachment:
pgpAhTntphPKz.pgp
Description: PGP signature