Debian 11 DLA-3885-1 Critical: Redis Denial-of-Service and Heap Overflow

* CVE-2023-45145: On startup, Redis began listening on a Unix
socket before adjusting its permissions to the user-provided
configuration. If a permissive umask(2) was used, this created a
race condition that enabled, during a short period of time,
another process to establish an otherwise unauthorized connection.

* CVE-2023-28856: Authenticated users could have used the
HINCRBYFLOAT command to create an invalid hash field that would
have crashed the Redis server on access.

* CVE-2023-25155: Authenticated users issuing specially crafted
SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an
integer overflow, resulting in a runtime assertion and termination
of the Redis server process.

* CVE-2022-36021: Authenticated users can use string matching
commands (like SCAN or KEYS) with a specially crafted pattern to
trigger a denial-of-service attack on Redis, causing it to hang
and consume 100% CPU time.