Debian alert DLA-4325-1 (redis)

From:
             
 
Chris Lamb <lamby@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4325-1] redis security update
Date:
             
 
Thu, 09 Oct 2025 11:08:18 -0700
Message-ID:
             
 
<176003128770.349328.14145938419774971348@bigcat>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4325-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
October 09, 2025                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : redis
Version        : 5:6.0.16-1+deb11u8
CVE IDs        : CVE-2025-46817 CVE-2025-46819 CVE-2025-49844
Debian Bug     : 1117553

Multiple vulnerabilities were discovered in Redis, a popular
key/value database:

* CVE-2025-46817: Fix an issue where an authenticated user could have
  used a specially-crafted Lua script to cause an integer overflow
  and potentially lead to remote code execution.

* CVE-2025-46819: Address a potential vulnerability where an
  authenticated user could have used a specially-crafted Lua script
  to read out-of-bound data and/or crash the server and thereby
  create a denial of service attack.

* CVE-2025-49844: Fix an issue where authenticated users could have
  exploited a specially-crafted Lua script to manipulate the garbage
  collector, trigger a use-after-free and potentially lead to remote
  code execution.

For Debian 11 bullseye, these problems have been fixed in version
5:6.0.16-1+deb11u8.

We recommend that you upgrade your redis packages.

For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmjn8jUACgkQHpU+J9Qx
HlhlTQ/8D9GPs05lSMD40BlAt1N3PLg+bB2TnV9TGQHn11HRSvyYLj9skdZJqndi
FzoWvf3nU5z+3cYrG6XujBmz0cnLUr6rgaT95sZd6lZNkBOTFv4nua/e53muGkQF
v36d/PnCMnwtu03LY2K572kk7WoC1ZD/1PxOqbwdxjTzefgMQ1p2YW8dTdDx0/NK
FwJeNhLPta6C9ozpk/TiCRtVl3BaJihmMLUXew3oFyxWEuDTtZq8G/MSH2XQtK3q
/GUnYuCPDd80xiUa8Brnlm6MhzpqYTbinufd52CH0ibg9ZxRLoXQatKfhJsfrhRe
kosp3VvvqjmcrlsqmQLHd6pGHXb+0dSWAc3RL+sfgXStCc8NfTeT0w9jp4IJXWHq
jxKM0paEiOtx3hQKvgSiujg7TjCr7ckX9vICST/NeVWp5kd2GN8AxDsa1mgxY4rr
gwlBsazAESSWtWGZ1FkQehG3BNJ5S8uVenk+Rz+rwGXDqiVnn+xdwMR1pnnkZnOm
OnkdUgnE2Fx+hyXJg6OMR3/fbjVNqZk/VZThnMiRDeAOQcMV8rUIdXlLTDf/Rxyu
0PHaTD/engBQjQMZVr0WdgEEEO+dDwBuTVDmvc4uDNk4SZYPaVtuUP+RZrRn+Y17
pTjkDpB29bfqg3zpsOOgikqsfZT0EnDJR6YyFAiwA4fTvvQj8wk=
=zC8A
-----END PGP SIGNATURE-----