git: 86c0781ad496 - main - security/vuxml: Document DoS vulnerability in redis and valkey

Go to: [ bottom of page ] [ top of archives ] [ this month ]
From: Yasuhiro Kimura <yasu_at_FreeBSD.org>
Date: Thu, 24 Apr 2025 08:22:08 UTC
The branch main has been updated by yasu:

URL: https://cgit.FreeBSD.org/ports/commit/?id=86c0781ad496e7ce78443a61d0098236efe06142

commit 86c0781ad496e7ce78443a61d0098236efe06142
Author:     Yasuhiro Kimura <yasu@FreeBSD.org>
AuthorDate: 2025-04-24 07:56:02 +0000
Commit:     Yasuhiro Kimura <yasu@FreeBSD.org>
CommitDate: 2025-04-24 08:20:30 +0000

    security/vuxml: Document DoS vulnerability in redis and valkey
---
 security/vuxml/vuln/2025.xml | 50 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index 5455c89cedde..caaa12fbe26c 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,53 @@
+  <vuln vid="af8d043f-20df-11f0-b9c5-000c295725e4">
+    <topic>redis,valkey -- DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client</topic>
+    <affects>
+      <package>
+	<name>redis</name>
+	<range><lt>7.4.3</lt></range>
+      </package>
+      <package>
+	<name>redis72</name>
+	<range><lt>7.2,8</lt></range>
+      </package>
+      <package>
+	<name>redis62</name>
+	<range><lt>6.2.18</lt></range>
+      </package>
+      <package>
+	<name>valkey</name>
+	<range><lt>8.1.1</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Axel Mierczuk reports:</p>
+	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff">
+	  <p>
+	    By default, the Redis configuration does not limit the
+	    output buffer of normal clients (see
+	    client-output-buffer-limit). Therefore, the output buffer
+	    can grow unlimitedly over time. As a result, the service
+	    is exhausted and the memory is unavailable.
+	  </p>
+	  <p>
+	    When password authentication is enabled on the Redis
+	    server, but no password is provided, the client can still
+	    cause the output buffer to grow from "NOAUTH" responses
+	    until the system will run out of memory.
+	  </p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2025-21605</cvename>
+      <url>https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff</url>
+    </references>
+    <dates>
+      <discovery>2025-04-23</discovery>
+      <entry>2025-04-24</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="11b71871-20ba-11f0-9471-2cf05da270f3">
     <topic>Gitlab -- Vulnerabilities</topic>
     <affects>