Summary
[8.0.4-1]
- update to 8.0.4
fixes CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023
[8.0.3.1]
- rebase to 8.0.3
[8.0.2.1]
- rebase to 8.0.2
Resolves: RHEL-73273
[7.2.6-2]
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
[7.2.6.1]
- rebase to 7.2.6
- merge limit.conf in main service files
- drop /etc/sysconfig/valkey
- rename compat package
- fix working dir
- partially enable upstream test suite
[7.2.5-4]
- Bump release for June 2024 mass rebuild
[7.2.5-3]
- remove version_no_tilde code
[7.2.5-2]
- move redis compat symlinks to compat subpackage
[7.2.5-1]
- update to 7.2.5 rhbz#2275379
[7.2.5~rc1-2]
- add compat subpackage with migration scripts from redis
[7.2.5~rc1-1]
- update to 7.2.5-rc1
[7.2.4~rc1-1]
- Initial package build, release candidate
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | valkey | 0:8.0.4-1.el10_0 |
| Oracle Linux · 10 | valkey-devel | 0:8.0.4-1.el10_0 |
Vulnerabilities 3
-
High 7.5
Redis DoS Vulnerability due to bad connection error handling
Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and…
-
High 7.0CVE-2025-32023 Public exploit
Redis allows out of bounds writes in hyperloglog commands leading to RCE
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially…
-
Medium 4.7
redis-check-aof may lead to stack overflow and potential RCE
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path i…