SUSE alert openSUSE-SU-2025-20121-1 (redis)

From:
             
 
meissner@suse.com
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2025-20121-1: critical: Security update for redis
Date:
             
 
Fri, 28 Nov 2025 12:04:32 +0100
Message-ID:
             
 
<20251128110432.21863FBA0@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for redis
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2025-20121-1
Rating: critical
References:

  * bsc#1250995
  * bsc#1252996



Cross-References:

  * CVE-2025-46817
  * CVE-2025-46818
  * CVE-2025-46819
  * CVE-2025-49844
  * CVE-2025-62507



CVSS scores:

  * CVE-2025-46817 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2025-46817 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-46818 ( SUSE ): 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  * CVE-2025-46818 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-46819 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
  * CVE-2025-46819 ( SUSE ): 7.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-49844 ( SUSE ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  * CVE-2025-49844 ( SUSE ): 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  * CVE-2025-62507 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2025-62507 ( SUSE ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 5 vulnerabilities and has 2 bug fixes can now be installed.

Description:

This update for redis fixes the following issues:

- Updated to 8.2.3 (boo#1252996 CVE-2025-62507)
  * https://github.com/redis/redis/releases/tag/8.2.3
  - Security fixes
    - (CVE-2025-62507) Bug in `XACKDEL` may lead to stack overflow
      and potential RCE
  - Bug fixes
    - `HGETEX`: A missing `numfields` argument when `FIELDS` is
      used can lead to Redis crash
    - An overflow in `HyperLogLog` with 2GB+ entries may result in
      a Redis crash
    - Cuckoo filter - Division by zero in Cuckoo filter insertion
    - Cuckoo filter - Counter overflow
    - Bloom filter - Arbitrary memory read/write with invalid
      filter
    - Bloom filter - Out-of-bounds access with empty chain
    - Top-k - Out-of-bounds access
    - Bloom filter - Restore invalid filter [We thank AWS security
      for responsibly disclosing the security bug]

- Updated to 8.2.2 (boo#1250995)
  * https://github.com/redis/redis/releases/tag/8.2.2
  * Fixed Lua script may lead to remote code execution (CVE-2025-49844).
  * Fixed Lua script may lead to integer overflow (CVE-2025-46817).
  * Fixed Lua script can be executed in the context of another user
    (CVE-2025-46818).
  * Fixed LUA out-of-bound read (CVE-2025-46819).
  * Fixed potential crash on Lua script or streams and HFE defrag.
  * Fixed potential crash when using ACL rules.
  * Added VSIM: new EPSILON argument to specify maximum distance.
  * Added SVS-VAMANA: allow use of BUILD_INTEL_SVS_OPT flag.
  * Added RESP3 serialization performance.
  * Added INFO SEARCH: new SVS-VAMANA metrics.

- Updated to 8.2.1
  * https://github.com/redis/redis/releases/tag/8.2.1
  - Bug fixes
    * #14240 INFO KEYSIZES - potential incorrect histogram updates
      on cluster mode with modules
    * #14274 Disable Active Defrag during flushing replica
    * #14276 XADD or XTRIM can crash the server after loading RDB
    * #Q6601 Potential crash when running FLUSHDB (MOD-10681)
  * Performance and resource utilization
    * Query Engine - LeanVec and LVQ proprietary Intel
      optimizations were removed from Redis Open Source
    * #Q6621 Fix regression in INFO (MOD-10779)


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-37=1

Package List:

- openSUSE Leap 16.0:

  redis-8.2.0-bp160.1.3

References:

  * https://www.suse.com/security/cve/CVE-2025-46817.html
  * https://www.suse.com/security/cve/CVE-2025-46818.html
  * https://www.suse.com/security/cve/CVE-2025-46819.html
  * https://www.suse.com/security/cve/CVE-2025-49844.html
  * https://www.suse.com/security/cve/CVE-2025-62507.html