Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 547
Alerts This Week
Warning Icon 1 547

RHEL 9.5: RHEL-2023-d14e19f2b Urgent: MySQL Memory Leak Issue

fedora
Calendar Grey March 11, 2023
Dist Fedora Esm H88
Update Redis version 7.0.9 on Fedora 38 to mitigate severe security vulnerabilities, such as integer overflow issues and denial-of-service (DoS) attacks.
**Redis 7.0.9** - Released Tue Feb 28 12:00:00 IST 2023 Upgrade urgency: SECURITY, contains fixes to security issues

Summary

Redis is an advanced key-value store. It is often referred to as a data

structure server since keys can contain strings, hashes, lists, sets and

sorted sets.

You can run atomic operations on these types, like appending to a string;

incrementing the value in a hash; pushing to a list; computing set

intersection, union and difference; or getting the member with highest

ranking in a sorted set.

In order to achieve its outstanding performance, Redis works with an

in-memory dataset. Depending on your use case, you can persist it either

by dumping the dataset to disk every once in a while, or by appending

each command to a log.

Redis also supports trivial-to-setup master-slave replication, with very

fast non-blocking first synchronization, auto-reconnection on net split

and so forth.

Other features include Transactions, Pub/Sub, Lua scripting, Keys with a

limited time-to-live, and configuration settings to make Redis behave like

a cache.

You can use Redis from most programming languages also.

**Redis 7.0.9** - Released Tue Feb 28 12:00:00 IST 2023 Upgrade urgency:

SECURITY, contains fixes to security issues. Security Fixes: *

(**CVE-2023-25155**) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD

commands can trigger an integer overflow, resulting in a runtime assertion and

termination of the Redis server process. * (**CVE-2022-36021**) String matching

commands (like SCAN or KEYS) with a specially crafted pattern to trigger a

denial-of-service attack on Redis, causing it to hang and consume 100% CPU

time. Bug Fixes * Fix a crash when reaching the maximum invalidations limit of

client-side tracking (#11814) * Fix a crash when SPUBLISH is used after passing

the cluster-link-sendbuf-limit (#11752) * Fix possible memory corruption in

FLUSHALL when a client watches more than one key (#11854) * Fix cluster inbound

link keepalive time (#11785) * Flush propagation list in active-expire of

writable replicas to fix an assertion (#11615) * Avoid propagating DEL of lazy

expire from SCAN and RANDOMKEY as MULTI-EXEC (#11788)

* Wed Feb 1 2023 Remi Collet - 7.0.9-1

- Upstream 7.0.9 release.

su -c 'dnf upgrade --advisory FEDORA-2023-b0768fba7b' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/

Do not reply to spam, report it:

Change Log

References

Update Instructions

Severity
critical
Lowest
Low
Medium
High
Critical

Product: Fedora 38
Version: 7.0.9
Release: 1.fc38
Summary: A persistent key-value database

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.