Source: redis Version: 5:7.0.9-1 Severity: grave Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for redis. Note this is not strictly speaking RC severity for the CVE issue, but it's only present in unstable, so let's avoid it might go to testing. Speaking of redis and bookworm, with the fix here applied, can you have a look at the regessions, and help redis migrate to testing? CVE-2023-28425[0]: | Redis is an in-memory database that persists on disk. Starting in | version 7.0.8 and prior to version 7.0.10, authenticated users can use | the MSETNX command to trigger a runtime assertion and termination of | the Redis server process. The problem is fixed in Redis version | 7.0.10. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-28425 https://www.cve.org/CVERecord?id=CVE-2023-28425 [1] https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c Regards, Salvatore
