Mon Jul 10 16:17:42 2023 UTC ()
redis: updated to 7.0.12

Redis 7.0.12

Upgrade urgency SECURITY: See security fixes below.

Security Fixes:
* (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger
  a heap overflow in the cjson and cmsgpack libraries, and result in heap
  corruption and potentially remote code execution. The problem exists in all
  versions of Redis with Lua scripting support, starting from 2.6, and affects
  only authenticated and authorized users.
* (CVE-2023-36824) Extracting key names from a command and a list of arguments
  may, in some cases, trigger a heap overflow and result in reading random heap
  memory, heap corruption and potentially remote code execution. Specifically:
  using COMMAND GETKEYS* and validation of key names in ACL rules.

Bug Fixes
* Re-enable downscale rehashing while there is a fork child
* Fix possible hang in HRANDFIELD, SRANDMEMBER, ZRANDMEMBER when used with `<count>`
* Improve fairness issue in RANDOMKEY, HRANDFIELD, SRANDMEMBER, ZRANDMEMBER, SPOP, and eviction
* Fix WAIT to be effective after a blocked module command being unblocked
* Avoid unnecessary full sync after master restart in a rare case


(adam)
diff -r1.80 -r1.81 pkgsrc/databases/redis/Makefile
diff -r1.73 -r1.74 pkgsrc/databases/redis/distinfo
cvs diff -r1.80 -r1.81 pkgsrc/databases/redis/Makefile (expand / switch to unified diff)

--- pkgsrc/databases/redis/Makefile 2023/04/19 05:01:08 1.80
+++ pkgsrc/databases/redis/Makefile 2023/07/10 16:17:42 1.81
@@ -1,16 +1,16 @@ @@ -1,16 +1,16 @@
1# $NetBSD: Makefile,v 1.80 2023/04/19 05:01:08 adam Exp $ 1# $NetBSD: Makefile,v 1.81 2023/07/10 16:17:42 adam Exp $
2 2
3DISTNAME= redis-7.0.11 3DISTNAME= redis-7.0.12
4CATEGORIES= databases 4CATEGORIES= databases
5MASTER_SITES= http://download.redis.io/releases/ 5MASTER_SITES= http://download.redis.io/releases/
6 6
7MAINTAINER= pkgsrc-users@NetBSD.org 7MAINTAINER= pkgsrc-users@NetBSD.org
8HOMEPAGE= https://redis.io/ 8HOMEPAGE= https://redis.io/
9COMMENT= Persistent key-value database with built-in net interface 9COMMENT= Persistent key-value database with built-in net interface
10LICENSE= modified-bsd 10LICENSE= modified-bsd
11 11
12TEST_DEPENDS+= tcl>=8.5:../../lang/tcl 12TEST_DEPENDS+= tcl>=8.5:../../lang/tcl
13 13
14USE_LANGUAGES= c99 14USE_LANGUAGES= c99
15USE_TOOLS+= gmake pkg-config 15USE_TOOLS+= gmake pkg-config
16 16
cvs diff -r1.73 -r1.74 pkgsrc/databases/redis/distinfo (expand / switch to unified diff)

--- pkgsrc/databases/redis/distinfo 2023/04/19 05:01:08 1.73
+++ pkgsrc/databases/redis/distinfo 2023/07/10 16:17:42 1.74
@@ -1,9 +1,9 @@ @@ -1,9 +1,9 @@
1$NetBSD: distinfo,v 1.73 2023/04/19 05:01:08 adam Exp $ 1$NetBSD: distinfo,v 1.74 2023/07/10 16:17:42 adam Exp $
2 2
3BLAKE2s (redis-7.0.11.tar.gz) = 372d2b4ed127e813546fd03d0c9dba03a8651e3392ac9ebab84445448ef13a09 3BLAKE2s (redis-7.0.12.tar.gz) = 78684d13cb52e713c14fcd6b3a5bdb686704f59ed47056da9790c5db439bb486
4SHA512 (redis-7.0.11.tar.gz) = 679c908b87b4e513401b49d7b87ac1cb03a29dd145dc2364afd579dd541a38feb5d65ee9b7077bb6ec96c3850812bdd475ca10d5cf92ebe52839ff1a2be89174 4SHA512 (redis-7.0.12.tar.gz) = 27ed0ab054d262028d236694f323387e3ef0e007de782545878011a7535e188152ed0af898dea4d6c0a7fa385849bbce6a0d85661780cb0e69c7d89dea3825b8
5Size (redis-7.0.11.tar.gz) = 2988485 bytes 5Size (redis-7.0.12.tar.gz) = 2992216 bytes
6SHA1 (patch-redis.conf) = ee657a9d82711263ceb0fb8f7d8059ed23528fe9 6SHA1 (patch-redis.conf) = ee657a9d82711263ceb0fb8f7d8059ed23528fe9
7SHA1 (patch-src_Makefile) = 2c23fb065e827e0cb25fdfba1bc1976db03dc789 7SHA1 (patch-src_Makefile) = 2c23fb065e827e0cb25fdfba1bc1976db03dc789
8SHA1 (patch-src_hyperloglog.c) = e9bdd3c630024a6fbe02c2c1d85e26131ad938cf 8SHA1 (patch-src_hyperloglog.c) = e9bdd3c630024a6fbe02c2c1d85e26131ad938cf
9SHA1 (patch-src_object.c) = 30ffaec9c7e6135e3a5576cd1a35d7bcec668299 9SHA1 (patch-src_object.c) = 30ffaec9c7e6135e3a5576cd1a35d7bcec668299