UbuntuUpdates.org

Package "redis-server"

Name: redis-server

Description:

Persistent key-value database with network interface
Latest version: 5:7.0.15-1ubuntu0.24.04.5
Release: noble (24.04)
Level: security
Repository: universe
Head package: redis
Homepage: https://redis.io/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "redis-server"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "redis-server" in Noble

Repository Area Version
base universe 5:7.0.15-1build2
updates universe 5:7.0.15-1ubuntu0.24.04.5

Changelog

Version: 5:7.0.15-1ubuntu0.24.04.5 2026-10-07 15:38:41 UTC

redis (5:7.0.15-1ubuntu0.24.04.5) noble-security; urgency=medium

  * SECURITY UPDATE: Use-after-free vulnerability in tlsProcessPendingData()
    - debian/patches/CVE-2026-81934.patch: Fix use-after-free in
      tlsProcessPendingData() pending-list iteration (#1391) in src/tls.c.
    - CVE-2026-81934
  * SECURITY UPDATE: Potential out-of-bounds read and denial of service
    vulnerability due to missing null-terminator check
    - debian/patches/CVE-2026-92925.patch: Reject cluster bus PING extensions
      with missing null terminator (#15263) in src/cluster.c.
    - CVE-2026-92925

 -- Hurman Thu, 01 Oct 2026 14:59:20 +0800
Source diff to previous version
CVE-2026-81934 Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configur
CVE-2026-92925 A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate

Version: 5:7.0.15-1ubuntu0.24.04.4 2026-04-13 19:10:39 UTC

  redis (5:7.0.15-1ubuntu0.24.04.4) noble-security; urgency=medium

  * SECURITY UPDATE: undefined behavior in bit.tohex
    - debian/patches/CVE-2024-31449.patch: explicitly check INT_MIN
      value in bit_tohex to prevent undefined behavior when negating
    - CVE-2024-31449

 -- Vyom Yadav <email address hidden> Sun, 12 Apr 2026 14:17:25 +0530
Source diff to previous version
CVE-2024-31449 Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack bu

Version: 5:7.0.15-1ubuntu0.24.04.3 2026-03-24 19:10:01 UTC

  redis (5:7.0.15-1ubuntu0.24.04.3) noble-security; urgency=medium

  * Non-maintainer upload.
  * Fix CVE-2025-32023: heap out-of-bounds write in HyperLogLog (LP: #2141721)

 -- Titi Wangsa Damhore <email address hidden> Thu, 12 Feb 2026 14:44:54 -0800
Source diff to previous version
2141721 CVE-2025-32023: Redis allows out of bounds writes in hyperloglog commands leading to RCE
CVE-2025-32023 Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use

Version: 5:7.0.15-1ubuntu0.24.04.2 2025-10-15 17:07:14 UTC

  redis (5:7.0.15-1ubuntu0.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2025-49844.patch: protect TString on stack
      during parsing to prevent use-after-free condition in lparser.c
    - CVE-2025-49844

 -- Sudhakar Verma <email address hidden> Mon, 13 Oct 2025 20:52:23 +0530
Source diff to previous version
CVE-2025-49844 Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lu

Version: 5:7.0.15-1ubuntu0.24.04.1 2025-03-05 14:06:46 UTC

  redis (5:7.0.15-1ubuntu0.24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2024-31228.patch: break out of recursion if the
      value of "nesting" is greater than 1000 in `src/util.c`
    - CVE-2024-31228
  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2024-46981.patch: reset GC state before closing
      the lua VM to prevent user data to be wrongly freed while still might
      be used on destructor callbacks.
    - CVE-2024-46981
  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2024-51741.patch: make '%w' and '%r' only valid
      permissions
    - CVE-2024-51741

 -- Shishir Subedi <email address hidden> Fri, 14 Feb 2025 12:43:06 +0545
CVE-2024-31228 Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, lo
CVE-2024-46981 Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the gar
CVE-2024-51741 Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector wh


About   -   Send Feedback to @ubuntu_updates