Date: Fri, 10 Jan 2025 05:24:09 GMT From: Yasuhiro Kimura <yasu@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: aefdc1ec77ef - main - security/vuxml: Document two valnerabilities in redis and valkey Message-ID: <202501100524.50A5O9QV073865@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by yasu: URL: https://cgit.FreeBSD.org/ports/commit/?id=aefdc1ec77ef09b119d9801f2363e1653720bb38 commit aefdc1ec77ef09b119d9801f2363e1653720bb38 Author: Yasuhiro Kimura <yasu@FreeBSD.org> AuthorDate: 2025-01-10 05:20:05 +0000 Commit: Yasuhiro Kimura <yasu@FreeBSD.org> CommitDate: 2025-01-10 05:23:35 +0000 security/vuxml: Document two valnerabilities in redis and valkey While here, update copyright year --- security/vuxml/vuln.xml | 2 +- security/vuxml/vuln/2025.xml | 82 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 83 insertions(+), 1 deletion(-) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index ba7314a9e226..f5af9b864a2a 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -25,7 +25,7 @@ <!ENTITY vuln-2025 SYSTEM "vuln/2025.xml"> ]> <!-- -Copyright 2003-2024 Jacques Vidrine and contributors +Copyright 2003-2025 Jacques Vidrine and contributors Redistribution and use in source (VuXML) and 'compiled' forms (SGML, HTML, PDF, PostScript, RTF and so forth) with or without modification, diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 5588926228b8..f4e44f9d9f30 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,85 @@ + <vuln vid="4d79fd1a-cc93-11ef-abed-08002784c58d"> + <topic>redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors</topic> + <affects> + <package> + <name>redis</name> + <range><ge>7.0.0</ge><lt>7.4.2</lt></range> + </package> + <package> + <name>redis72</name> + <range><lt>7.2.7</lt></range> + </package> + <package> + <name>valkey</name> + <range><lt>8.0.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Redis core team reports:</p> + <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9">; + <p> + An authenticated with sufficient privileges may create a + malformed ACL selector which, when accessed, triggers a + server panic and subsequent denial of service.The problem + exists in Redis 7.0.0 or newer. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-51741</cvename> + <url>https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9</url>; + </references> + <dates> + <discovery>2025-01-06</discovery> + <entry>2025-01-10</entry> + </dates> + </vuln> + + <vuln vid="5f19ac58-cc90-11ef-abed-08002784c58d"> + <topic>redis,valkey -- Remote code execution valnerability</topic> + <affects> + <package> + <name>redis</name> + <range><lt>7.4.2</lt></range> + </package> + <package> + <name>redis72</name> + <range><lt>7.2.7</lt></range> + </package> + <package> + <name>redis62</name> + <range><lt>6.2.17</lt></range> + </package> + <package> + <name>valkey</name> + <range><lt>8.0.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Redis core team reports:</p> + <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c">; + <p> + An authenticated user may use a specially crafted Lua + script to manipulate the garbage collector and potentially + lead to remote code execution. The problem exists in all + versions of Redis with Lua scripting. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-46981</cvename> + <url>https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c</url>; + </references> + <dates> + <discovery>2025-01-06</discovery> + <entry>2025-01-10</entry> + </dates> + </vuln> + <vuln vid="2bfde261-cdf2-11ef-b6b2-2cf05da270f3"> <topic>Gitlab -- Vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202501100524.50A5O9QV073865>