** Description changed: This bug tracks an update for the Valkey package, moving to versions: * stonking (26.10): Valkey 9.1.2 * resolute (26.04): Valkey 9.0.6 * noble (24.04): Valkey 7.2.14 These updates include bug fixes following the SRU special case documentation at https://documentation.ubuntu.com/sru/en/latest/reference/exception- Valkey-Updates [Upstream changes] - 9.1.2: + Upstream changelogs: + https://github.com/valkey-io/valkey/releases/tag/7.2.14 + https://github.com/valkey-io/valkey/releases/tag/9.0.6 + https://github.com/valkey-io/valkey/releases/tag/9.1.2 - Security fixes: - GHSA-jcj7-v34w-v9vv - GHSA-fq2f-crmw-q97r + The new versions contain fixes for the following CVEs and security + issues: + (CVE-2026-56684) A use-after-free in TLS connection handling could allow an authenticated client to achieve remote code execution using CLIENT KILL (7.2.14, 9.0.5+) + (CVE-2026-63639) Corrupt stream RDB files containing a shared NACK across consumers could allow remote code execution (7.2.14, 9.0.5+) + (CVE-2026-25243) Invalid memory access when loading a malformed zipmap payload via RESTORE (7.2.x) + (GHSA-jcj7-v34w-v9vv) A use-after-free in RDMA connection handling could allow an authenticated client to crash the server using CLIENT KILL; only affects servers built with USE_RDMA and configured with an RDMA listener (9.0.6, 9.1.2) + (GHSA-fq2f-crmw-q97r) An unauthenticated use-after-free of the Lua interpreter state, caused by a process-global script debugger command table that cached a raw pointer to a freed interpreter and was never invalidated (9.1.2) - TODO: List updates, CVE fixes, and relevant bug fixes - TODO: Add a link to the upstream changelog + The other bugs listed upstream are: - TODO: Specifically note any backwards-incompatible changes or features - added by upstream and their announcements/release notes and relevant - commits. + 9.1.2 - + https://github.com/valkey-io/valkey/pull/4211 + https://github.com/valkey-io/valkey/pull/4253 + https://github.com/valkey-io/valkey/pull/3721 + https://github.com/valkey-io/valkey/pull/3611 + https://github.com/valkey-io/valkey/pull/3973 + https://github.com/valkey-io/valkey/pull/4342 + https://github.com/valkey-io/valkey/pull/3971 + https://github.com/valkey-io/valkey/pull/4323 + https://github.com/valkey-io/valkey/pull/4360 + https://github.com/valkey-io/valkey/pull/4410 + https://github.com/valkey-io/valkey/pull/3984 + https://github.com/valkey-io/valkey/pull/4395 + https://github.com/valkey-io/valkey/pull/4531 + https://github.com/valkey-io/valkey/pull/4576 + https://github.com/valkey-io/valkey/pull/4577 + https://github.com/valkey-io/valkey/pull/4104 + https://github.com/valkey-io/valkey/pull/4229 + https://github.com/valkey-io/valkey/pull/4210 + https://github.com/valkey-io/valkey/pull/4155 + https://github.com/valkey-io/valkey/pull/4301 + https://github.com/valkey-io/valkey/pull/4302 + https://github.com/valkey-io/valkey/pull/4300 + https://github.com/valkey-io/valkey/pull/4320 + https://github.com/valkey-io/valkey/pull/4312 + https://github.com/valkey-io/valkey/pull/4346 + https://github.com/valkey-io/valkey/pull/4307 + https://github.com/valkey-io/valkey/pull/4272 + https://github.com/valkey-io/valkey/pull/4376 + https://github.com/valkey-io/valkey/pull/4327 + https://github.com/valkey-io/valkey/pull/3972 + https://github.com/valkey-io/valkey/pull/3922 + https://github.com/valkey-io/valkey/pull/4381 + https://github.com/valkey-io/valkey/pull/4401 + https://github.com/valkey-io/valkey/pull/4212 + https://github.com/valkey-io/valkey/pull/4440 + https://github.com/valkey-io/valkey/pull/4459 + https://github.com/valkey-io/valkey/pull/4559 + + 9.0.5-9.0.6 - + https://github.com/valkey-io/valkey/pull/2872 + https://github.com/valkey-io/valkey/pull/3283 + https://github.com/valkey-io/valkey/pull/3342 + https://github.com/valkey-io/valkey/pull/3516 + https://github.com/valkey-io/valkey/pull/3458 + https://github.com/valkey-io/valkey/pull/3498 + https://github.com/valkey-io/valkey/pull/3591 + https://github.com/valkey-io/valkey/pull/3578 + https://github.com/valkey-io/valkey/pull/3641 + https://github.com/valkey-io/valkey/pull/3448 + https://github.com/valkey-io/valkey/pull/3800 + https://github.com/valkey-io/valkey/pull/3846 + https://github.com/valkey-io/valkey/pull/4047 + https://github.com/valkey-io/valkey/pull/4024 + https://github.com/valkey-io/valkey/pull/4068 + https://github.com/valkey-io/valkey/pull/3306 + https://github.com/valkey-io/valkey/pull/3878 + https://github.com/valkey-io/valkey/pull/3950 + https://github.com/valkey-io/valkey/pull/3541 + https://github.com/valkey-io/valkey/pull/3554 + https://github.com/valkey-io/valkey/pull/3503 + https://github.com/valkey-io/valkey/pull/3568 + https://github.com/valkey-io/valkey/pull/3596 + https://github.com/valkey-io/valkey/pull/3610 + https://github.com/valkey-io/valkey/pull/3743 + https://github.com/valkey-io/valkey/pull/3942 + https://github.com/valkey-io/valkey/pull/3941 + https://github.com/valkey-io/valkey/pull/3920 + https://github.com/valkey-io/valkey/pull/3921 + https://github.com/valkey-io/valkey/pull/3787 + https://github.com/valkey-io/valkey/pull/4060 + https://github.com/valkey-io/valkey/pull/3939 + https://github.com/valkey-io/valkey/pull/2846 + https://github.com/valkey-io/valkey/pull/2811 + https://github.com/valkey-io/valkey/pull/4105 + https://github.com/valkey-io/valkey/pull/3723 + https://github.com/valkey-io/valkey/pull/3443 + https://github.com/valkey-io/valkey/pull/3440 + https://github.com/valkey-io/valkey/pull/3847 + https://github.com/valkey-io/valkey/pull/3848 + https://github.com/valkey-io/valkey/pull/4182 + https://github.com/valkey-io/valkey/pull/3359 + https://github.com/valkey-io/valkey/pull/3580 + https://github.com/valkey-io/valkey/pull/3872 + https://github.com/valkey-io/valkey/pull/3811 + https://github.com/valkey-io/valkey/pull/3843 + https://github.com/valkey-io/valkey/pull/3209 + https://github.com/valkey-io/valkey/pull/3281 + https://github.com/valkey-io/valkey/pull/3586 + https://github.com/valkey-io/valkey/pull/3335 + https://github.com/valkey-io/valkey/pull/4211 + https://github.com/valkey-io/valkey/pull/4253 + https://github.com/valkey-io/valkey/pull/3973 + https://github.com/valkey-io/valkey/pull/4342 + https://github.com/valkey-io/valkey/pull/3971 + https://github.com/valkey-io/valkey/pull/4360 + https://github.com/valkey-io/valkey/pull/3721 + https://github.com/valkey-io/valkey/pull/4410 + https://github.com/valkey-io/valkey/pull/3984 + https://github.com/valkey-io/valkey/pull/4395 + https://github.com/valkey-io/valkey/pull/4531 + https://github.com/valkey-io/valkey/pull/4576 + https://github.com/valkey-io/valkey/pull/4577 + https://github.com/valkey-io/valkey/pull/4414 + https://github.com/valkey-io/valkey/pull/4452 + https://github.com/valkey-io/valkey/pull/4104 + https://github.com/valkey-io/valkey/pull/4229 + https://github.com/valkey-io/valkey/pull/4210 + https://github.com/valkey-io/valkey/pull/4301 + https://github.com/valkey-io/valkey/pull/4300 + https://github.com/valkey-io/valkey/pull/4320 + https://github.com/valkey-io/valkey/pull/4312 + https://github.com/valkey-io/valkey/pull/4307 + https://github.com/valkey-io/valkey/pull/3972 + https://github.com/valkey-io/valkey/pull/4212 + https://github.com/valkey-io/valkey/pull/4302 + https://github.com/valkey-io/valkey/pull/3922 + https://github.com/valkey-io/valkey/pull/4381 + https://github.com/valkey-io/valkey/pull/4459 + https://github.com/valkey-io/valkey/pull/4559 + + 7.2.13-7.2.14 - + https://github.com/valkey-io/valkey/pull/2872 + https://github.com/valkey-io/valkey/pull/3342 + https://github.com/valkey-io/valkey/pull/3498 + https://github.com/valkey-io/valkey/pull/3641 + https://github.com/valkey-io/valkey/pull/1826 + https://github.com/valkey-io/valkey/pull/3846 + https://github.com/valkey-io/valkey/pull/3541 + https://github.com/valkey-io/valkey/pull/3610 + https://github.com/valkey-io/valkey/pull/3619 + https://github.com/valkey-io/valkey/pull/3920 + https://github.com/valkey-io/valkey/pull/3921 + https://github.com/valkey-io/valkey/pull/3787 + https://github.com/valkey-io/valkey/pull/2750 + https://github.com/valkey-io/valkey/pull/3591 + https://github.com/valkey-io/valkey/pull/3939 + https://github.com/valkey-io/valkey/pull/3847 + https://github.com/valkey-io/valkey/pull/3848 + https://github.com/valkey-io/valkey/pull/3548 + https://github.com/valkey-io/valkey/pull/3580 + https://github.com/valkey-io/valkey/pull/3843 + https://github.com/valkey-io/valkey/pull/3209 + https://github.com/valkey-io/valkey/pull/3586 + + Looking through the description of each fix, I found no backwards- + incompatible changes. [Test Plan] - TODO: Check DEP-8 and reverse-depends DEP-8 tests pass - TODO: if there are any non passing tests - explain why that is ok in this case - TODO: add results of an autopkgtest run against all the new versions + Initial testing includes making sure DEP-8 and reverse-depends DEP-8 + tests all pass. This package includes a large suite of tests that check + various runtime configurations and redis compatibility for noble + + resolute. Autopkgtest results for all new versions will be added once + the packages are available. [Regression Potential] Upstream has an extensive build and integration test suite. So regressions would likely arise from a change in interaction with Ubuntu- specific integrations. - TODO: consider any other regression potential specific to the version being - updated and list if any. + [Other Info] + + Previous Backports: + (LP: #2151296) + (LP: #2127122) + (LP: #2115258) + (LP: #2097546) + (LP: #2091129)
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2153491 Title: Update Valkey to 7.2.14 in noble, 9.0.6 in resolute, and 9.1.2 in stonking To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/valkey/+bug/2153491/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
