FEDORA-2025-72fd0442cc — security update for redis

stable

redis-7.2.7-1.fc40

FEDORA-2025-72fd0442cc created by remi 10 months ago for Fedora 40

Redis 7.2.7 Released Mon 6 Jan 2025 12:30:00 IDT

Upgrade urgency SECURITY: See security fixes below.

Security fixes

(CVE-2024-46981) Lua script commands may lead to remote code execution
(CVE-2024-51741) Denial-of-service due to malformed ACL selectors

Bug fixes

13380 Possible crash due to OOM panic on invalid command
13338 Streams: XINFO lag field is wrong when tombstone is after the last_id of the consume group
13473 Streams: XTRIM does not update the maximal tombstone, leading to an incorrect lag
13311 Cluster: crash due to unblocking client during slot migration
13443 Cluster: crash when loading cluster config
13422 Cluster: CLUSTER SHARDS returns empty array
13465 Cluster: incompatibility with older node versions

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2025-72fd0442cc

This update has been submitted for testing by remi.

10 months ago

This update's test gating status has been changed to 'ignored'.

10 months ago

This update has been pushed to testing.

10 months ago

remi edited this update.

10 months ago

This update has been submitted for stable by bodhi.

10 months ago

This update has been pushed to stable.

10 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

low

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

10 months ago

in testing

10 months ago

in stable

10 months ago

modified

10 months ago

approved

10 months ago

Builds

redis-7.2.7-1.fc40

BZ#2336072 CVE-2024-51741 redis: Redis allows denial-of-service due to malformed ACL selectors [fedora-40]

BZ#2336073 CVE-2024-46981 redis: Redis' Lua library commands may lead to remote code execution [fedora-40]

redis-7.2.7-1.fc40

Automated Test Results

ignored