Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Fedora 40: redis 2024-5d4eb04e76 Security Advisory Updates

fedora
Calendar Grey October 12, 2024
Dist Fedora Esm H88
Upgrade your Redis installation on Fedora 40 with security fixes addressing potential remote code execution and denial of service risks.
Redis Community Edition 7.2.6 Released Wed 02 Oct 2024 20:17:04 IDT Upgrade urgency SECURITY: See security fixes below

Summary

Redis is an advanced key-value store. It is often referred to as a data

structure server since keys can contain strings, hashes, lists, sets and

sorted sets.

You can run atomic operations on these types, like appending to a string;

incrementing the value in a hash; pushing to a list; computing set

intersection, union and difference; or getting the member with highest

ranking in a sorted set.

In order to achieve its outstanding performance, Redis works with an

in-memory dataset. Depending on your use case, you can persist it either

by dumping the dataset to disk every once in a while, or by appending

each command to a log.

Redis also supports trivial-to-setup master-slave replication, with very

fast non-blocking first synchronization, auto-reconnection on net split

and so forth.

Other features include Transactions, Pub/Sub, Lua scripting, Keys with a

limited time-to-live, and configuration settings to make Redis behave like

a cache.

You can use Redis from most programming languages also.

Update Information:

Redis Community Edition 7.2.6 Released Wed 02 Oct 2024 20:17:04 IDT Upgrade urgency SECURITY: See security fixes below. Security fixes CVE-2024-31449 Lua library commands may lead to stack overflow and potential RCE. CVE-2024-31227 Potential Denial-of-service due to malformed ACL selectors. CVE-2024-31228 Potential Denial-of-service due to unbounded pattern matching.

Change Log

* Thu Oct 3 2024 Remi Collet - 7.2.6-1 - Upstream 7.2.6 release

References


[ 1 ] Bug #2317405 - CVE-2024-31228 redis: Denial-of-service due to unbounded pattern matching in Redis [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2317405 [ 2 ] Bug #2317408 - CVE-2024-31449 redis: Lua library commands may lead to stack overflow and RCE in Redis [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2317408 [ 3 ] Bug #2317414 - CVE-2024-31227 redis: Denial-of-service due to malformed ACL selectors in Redis [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2317414

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-5d4eb04e76' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: redis
Product: Fedora 40
Version: 7.2.6
Release: 1.fc40
Summary: A persistent key-value database

Topics%20covered

Topics Covered

No topics assigned

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here