FEDORA-2023-fbfe7a6cfe — security update for redis

stable

redis-7.0.8-1.fc37

FEDORA-2023-fbfe7a6cfe created by remi 2 years ago for Fedora 37

Redis 7.0.8 Released Mon Jan 16 12:00:00 IDT 2023

Security Fixes:

(CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic
(CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands can lead to denial-of-service

Bug Fixes

Avoid possible hang when client issues long KEYS, SRANDMEMBER, HRANDFIELD, and ZRANDMEMBER commands and gets disconnected by client output buffer limit (#11676)
Make sure that fork child doesn't do incremental rehashing (#11692)
Fix a bug where blocking commands with a sub-second timeout would block forever (#11688)
Fix sentinel issue if replica changes IP (#11590)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-fbfe7a6cfe

This update has been submitted for testing by remi.

2 years ago

This update's test gating status has been changed to 'ignored'.

2 years ago

remi edited this update.

2 years ago

This update has been pushed to testing.

2 years ago

remi edited this update.

2 years ago

remi edited this update.

2 years ago

frantisekz commented & provided feedback 2 years ago

karma

Works well

This update has been submitted for stable by bodhi.

2 years ago

This update has been pushed to stable.

2 years ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

2 years ago

in testing

2 years ago

in stable

2 years ago

modified

2 years ago

approved

2 years ago

Builds

redis-7.0.8-1.fc37

BZ#2163132 CVE-2023-22458 redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service

BZ#2163133 CVE-2022-35977 redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic

BZ#2163174 CVE-2023-22458 redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service [fedora-37]

BZ#2163193 CVE-2022-35977 redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic [fedora-37]

redis-7.0.8-1.fc37

Automated Test Results

ignored