Aron Xu pushed to branch master at Debian Security Tracker / security-tracker
Commits:
5a2e4352 by Aron Xu at 2026-09-30T11:41:02+08:00
Triage redis/valkey/redict issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -38679,13 +38679,19 @@ CVE-2026-82679 (A security flaw has been discovered
in diem-project diem up to 5
CVE-2026-82678 (A vulnerability was identified in diem-project diem up to
5.1.3. The a ...)
NOT-FOR-US: diem-project diem
CVE-2026-82677 (A vulnerability was determined in valkey-io valkey 9.1.0.
Impacted is ...)
+ - redict <unfixed>
+ - redis <unfixed>
- valkey 9.1.2-1 (bug #1146641)
NOTE: https://github.com/valkey-io/valkey/issues/4200
NOTE: https://github.com/valkey-io/valkey/pull/4211
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7
(unstable)
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/9461cbaadcf92d090c409fb065ee25afde811221
(9.1.2)
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/345a057196edbd94f2f0be87d26a1299fcd95e60
(8.1.10)
- TODO: check redis, restic?
+ NOTE: redis shares this flaw and is unfixed upstream:
moduleTimerHandler() removes and frees
+ NOTE: the timer after the callback returns, even when the callback
already stopped it through
+ NOTE: RM_StopTimer(). Reproduced on redis 8.0.2 with a module whose
timer callback stops
+ NOTE: its own timer: "free(): double free detected in tcache 2". The
same unconditional
+ NOTE: free after the callback is present on the redis 7.2, 8.0 and
unstable branches.
CVE-2026-82671 (A vulnerability has been found in IObit Unlocker 1.3.0.12.
This vulner ...)
NOT-FOR-US: IObit
CVE-2026-82670 (A flaw has been found in IObit Uninstaller 15.5.0.11. This
affects the ...)
@@ -38723,13 +38729,18 @@ CVE-2026-82659 (nodemailer before 9.0.1 fails to
apply disableFileAccess and dis
[bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE:
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f
CVE-2026-82631 (A security flaw has been discovered in valkey-io valkey 9.1.0.
The aff ...)
+ - redict <unfixed>
+ - redis <unfixed>
- valkey 9.1.2-1 (bug #1146641)
NOTE: https://github.com/valkey-io/valkey/issues/4198
NOTE: https://github.com/valkey-io/valkey/pull/4212
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b
(unstable)
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/e07a231cc607bffd39092efdd2c4344068557a9f
(9.1.2)
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/f17a71df6ccd9a2476fd7534deb135593a8242bb
(8.1.10)
- TODO: check resis and restic
+ NOTE: redis is affected by the same flaw and fixed it without a CVE id,
by:
+ NOTE:
https://github.com/redis/redis/commit/a8edcfc98c50bb01c850e5dab3998ce57807144d
(#15594)
+ NOTE: The fix is present on the redis 7.2 and 8.2 branches but not on
7.0 or 8.0, so all
+ NOTE: redis versions in Debian are affected.
CVE-2026-82630 (A vulnerability was identified in PowerJob up to 5.1.2.
Impacted is th ...)
NOT-FOR-US: PowerJob
CVE-2026-82629 (A vulnerability was determined in jeecgboot jeewx-boot up to
641ab52c3 ...)
@@ -41514,6 +41525,7 @@ CVE-2026-81934 (Redis contains a use-after-free
vulnerability in the 'tlsProcess
{DLA-4794-1}
- redis 5:8.0.6-3 (bug #1147423)
NOTE:
https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834
(8.8.2)
+ NOTE: The same flaw in valkey is tracked in CVE-2026-56684
CVE-2026-81931 (Unrestricted Upload of File with Dangerous Type in the product
photo u ...)
NOT-FOR-US: Roskus Prospero Flow CRM
CVE-2026-81851 (A heap-based buffer overflow vulnerability in Fireware OS's
iked proce ...)
@@ -54650,12 +54662,14 @@ CVE-2026-63641 (MagicMirror\xb2 is an open source
modular smart mirror platform.
CVE-2026-63640 (MagicMirror\xb2 is an open source modular smart mirror
platform. Prior ...)
NOT-FOR-US: MagicMirror
CVE-2026-63639 (Valkey is a distributed key-value database. Prior to 7.2.14,
8.0.10, 8 ...)
+ - redict <unfixed>
- valkey 9.1.1-1 (bug #1144957)
NOTE:
https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4
NOTE: https://github.com/valkey-io/valkey/pull/4073
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291
(8.1.9)
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778
(8.0.10)
- TODO: check redis and redict
+ NOTE: The same flaw in redis is tracked in CVE-2026-66373, where redis
is not-affected
+ NOTE: because the incomplete fix for CVE-2026-25243 was never applied
CVE-2026-63632 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
- onnx <unfixed> (bug #1145196)
[trixie] - onnx <no-dsa> (Minor issue)
@@ -54729,11 +54743,12 @@ CVE-2026-59781 (When Zabbix Agent was installed on
Windows into a custom install
CVE-2026-57580 (authentik is an open-source identity provider. Prior to
2026.2.6 and 2 ...)
NOT-FOR-US: authentik
CVE-2026-56684 (Valkey is a distributed key-value database. Prior to 7.2.14,
8.0.10, 8 ...)
+ - redict <unfixed>
- valkey 9.1.1-1 (bug #1144956)
NOTE:
https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh
NOTE: https://github.com/valkey-io/valkey/pull/4234
NOTE: Fixed by:
https://github.com/valkey-io/valkey/commit/33b14adf2026cfd8728607b026edb24843805844
(8.1.9)
- TODO: check redis and redict
+ NOTE: The same flaw in redis is tracked in CVE-2026-81934
CVE-2026-55839 (Kestra is an open-source, event-driven orchestration platform.
Prior t ...)
NOT-FOR-US: Kestra
CVE-2026-55166 (Lemur manages TLS certificate creation. Prior to 1.9.2,
authenticated ...)
@@ -81967,6 +81982,8 @@ CVE-2026-66373 (Redis before 8.8.0, in the unusual case
where an authenticated a
NOTE: Fixed by:
https://github.com/redis/redis/commit/04292292f2f5c180322292007a599a700611ebaf
(7.2.15)
NOTE: fixed by:
https://github.com/redis/redis/commit/41a958720e64e03576dd652d224aa46d22c096c3
(6.2.23)
NOTE: Issue exists because of an incomplete fix for CVE-2026-25243.
+ NOTE: The same flaw in valkey is tracked in CVE-2026-63639, where
valkey was affected and
+ NOTE: fixed it in 9.1.1-1
CVE-2026-66339 (A flaw was found in libsoup. After a CONNECT tunnel is
established thr ...)
- libsoup3 <unfixed> (bug #1142846)
[trixie] - libsoup3 <no-dsa> (Minor issue)
@@ -146171,34 +146188,49 @@ CVE-2026-25589 (RedisBloom is a probabilistic data
structures module for Redis.
CVE-2026-25588 (RedisTimeSeries is a time-series module for Redis. In all
versions bef ...)
NOT-FOR-US: RedisTimeSeries Redis module
CVE-2026-25243 (Redis is an in-memory data structure store. In versions of
redis-serve ...)
+ - redict <unfixed>
{DLA-4682-1}
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
[bullseye] - redis <not-affected> (Vulnerable code not present; checks
for dups introduced later)
+ - valkey 9.1.1-1
NOTE:
https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4
NOTE: https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive
NOTE: Fixed by:
https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02
(8.6.3)
NOTE: When fixing this issue make the fix complete with the followups
for CVE-2026-66373 to
NOTE: open up CVE-2026-66373.
- TODO: check redict and valkey
+ NOTE: valkey is affected as well, zipmapValidateIntegrity() lacks the
overlong length-encoding
+ NOTE: check; ASan heap-buffer-overflow in zipmapDecodeLength() on
8.1.1+dfsg1-3+deb13u2.
+ NOTE: valkey fixed by:
https://github.com/valkey-io/valkey/commit/fea0b4064cf612d1c365b032326832bff0946bd9
(8.1.7)
CVE-2026-23631 (Redis is an in-memory data structure store. In all versions of
redis-s ...)
+ - redict <unfixed>
{DLA-4682-1}
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
[bullseye] - redis <ignored> (Invasive to backport entire timedOut
mechanism etc.)
+ - valkey 9.1.1-1
NOTE:
https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826
NOTE: https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica
NOTE: Fixed by:
https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb
(8.6.3)
- TODO: check redict and valkey
+ NOTE: valkey is affected as well, readSyncBulkPayload() has no
isInsideYieldingLongCommand()
+ NOTE: guard; valkey 8.1.4 and earlier lack the fix.
+ NOTE: valkey fixed by:
https://github.com/valkey-io/valkey/commit/c7c92db43b63be0599a076590f012ed35d279a47
(8.1.7)
+ NOTE: redict has the yielding-long-command mechanism but
readSyncBulkPayload() lacks the guard
CVE-2026-23479 (Redis is an in-memory data structure store. In redis-server
from 7.2.0 ...)
+ - redict <unfixed>
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
[bookworm] - redis <not-affected> (Vulnerable code not present)
[bullseye] - redis <not-affected> (Vulnerable code not present)
+ - valkey 9.1.1-1
NOTE:
https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3
NOTE: https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive
NOTE: Fixed by:
https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea
(8.6.3)
- TODO: check redict and valkey
+ NOTE: valkey is affected as well, unblockClientOnKey() ignores the
C_ERR return of
+ NOTE: processCommandAndResetClient(); reproduced under ASan on
8.1.1+dfsg1-3+deb13u2.
+ NOTE: valkey fixed by:
https://github.com/valkey-io/valkey/commit/1d7224f3894c8e6db39a9e86c040270b3122c064
(8.1.7)
+ NOTE: redict 7.3.x is based on redis 7.2.4, so unlike bookworm/bullseye
the reprocess-on-unblock
+ NOTE: path is present; unblockClientOnKey() calls
processCommandAndResetClient() unchecked
CVE-2025-66369 (An issue was discovered in MM in Samsung Mobile Processor,
Wearable Pr ...)
NOT-FOR-US: Samsung
CVE-2025-61669 (Jupyter Server is the backend for Jupyter web applications. In
jupyter ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5a2e4352b5d939946d15a8a27e5e3841c89318d2
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5a2e4352b5d939946d15a8a27e5e3841c89318d2
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
