[SECURITY] [DLA 4794-1] redis security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4794-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Chris Lamb
September 24, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : redis
Version : 5:7.0.15-1~deb12u10
CVE ID : CVE-2026-81934 CVE-2026-92925
Debian Bug : 1147423 1148265
It was discovered that there were two vulnerabilities in the Redis
key/value database.
CVE-2026-81934
CVE-2026-81934: Prevent a use-after-free vulnerability in the
handling of pending TLS data. A remote, unauthenticated attacker
may have been able to execute arbitrary commands with the
privileges of the Redis server.
CVE-2026-92925
Prevent an out-of-bounds vulnerability in the handling of cluster
ping extensions. This could have allowed a remote attacker to
craft a malicious packet, leading to an out-of-bounds read when
the packet's payload was processed.
For Debian 12 bookworm, these problems have been fixed in version
5:7.0.15-1~deb12u10.
We recommend that you upgrade your redis packages.
For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmq1rqkACgkQHpU+J9Qx
HlhNOw/+PIYaBtDLToK4ZwDmXzs68oWdj1gMxVCHVs0Uliirwqn3GRGvxyDYW+tt
vS04VCYkUOxAhYBeNSZuBYNtShIvYrpkHvGmwF584h5vjp7XeaF7pt+cNtV4s1MH
/z5XS8at6LpHb67+69TfymOnYz153RC0Ql9yAAiOI1TmqbcLa/fpVtGdmuEDsQkx
kDdNGbFG4kU5V0qLR9ta/bReFoLOVrNnzVqfJ6wFDn2cby3SUeBxJpO2k0bSGaJG
xo1TypzRTm0aysuy5FFfuJA6PFQWwZE3OdTeWK8rkvmb+3ahIQgJkIRF7rOlY+WY
l5l/Y2x+6yIrnFkL1lzB+huROB96keEdBMZsvDYjYzGBon+JW28O9TTBNMGk8VUx
PEtTdKmkUj32e4QQqTnDegk0keEBkAzUYg74a/uRLqv/NYxnXaa+xAXDB4efPVv6
tpc5TGkzeOLxk0Lxpn71qHkP+09CGQKln23CC7wFH1Y2sD1alWc0xXKiSUMz3CMp
imR9oZuIqS8caWTuq6rv2g8qAFvgdqxhFEFgcDuUdz8aP9ndzKK4WbpnFsay0BuS
yWYMI2g8RxxMD6wNmOm2sLF5XY0/UU19/xX1PZcObPRkm6pTbzsXIZk8Va/nH+Jh
yGyvufi9QItU8QxbNQJ+uiI3aecNOCLptaxWEyF07Csk0V+jogI=
=W3Ye
-----END PGP SIGNATURE-----
Reply to: