FEDORA-2023-e4e3393396 — security update for redis

stable

redis-7.0.11-1.fc38

FEDORA-2023-e4e3393396 created by remi 3 years ago for Fedora 38

Redis 7.0.11 Released Mon Apr 17 16:00:00 IST 2023

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:

(CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access

Bug Fixes

Add a missing fsync of AOF file in rare cases (#11973)
Disconnect pub-sub subscribers when revoking allchannels permission (#11992)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-e4e3393396

This update has been submitted for testing by remi.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update has been pushed to testing.

3 years ago

frantisekz provided feedback 3 years ago

karma

This update has been submitted for stable by bodhi.

3 years ago

This update has been pushed to stable.

3 years ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

3 years ago

in testing

3 years ago

in stable

3 years ago

approved

3 years ago

Builds

redis-7.0.11-1.fc38

BZ#2187525 CVE-2023-28856 redis: Insufficient validation of HINCRBYFLOAT command

BZ#2187528 CVE-2023-28856 redis: Insufficient validation of HINCRBYFLOAT command [fedora-37]

redis-7.0.11-1.fc38

Automated Test Results

ignored