FEDORA-2023-04239b5758 — security update for redis

stable

redis-6.2.12-1.fc36

FEDORA-2023-04239b5758 created by remi a year ago for Fedora 36

Redis 6.2.12 Released Mon Apr 17 16:00:00 IST 2023

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:

(CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access

Bug Fixes

Fix CLIENT REPLY OFF|SKIP to not silence push notifications (#11875)
Disconnect pub-sub subscribers when revoking allchannels permission (#11992)
Trim excessive memory usage in stream nodes when exceeding stream-node-max-bytes (#11885)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-04239b5758

This update has been submitted for testing by remi.

a year ago

This update's test gating status has been changed to 'ignored'.

a year ago

This update has been pushed to testing.

a year ago

This update has been submitted for stable by bodhi.

a year ago

This update has been pushed to stable.

a year ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

redis-6.2.12-1.fc36

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

a year ago

in testing

a year ago

in stable

a year ago

approved

a year ago

BZ#2187525 CVE-2023-28856 redis: Insufficient validation of HINCRBYFLOAT command

BZ#2187527 CVE-2023-28856 redis: Insufficient validation of HINCRBYFLOAT command [fedora-36]

redis-6.2.12-1.fc36

Automated Test Results

ignored