git: aefdc1ec77ef - main - security/vuxml: Document two valnerabilities in redis and valkey
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 10 Jan 2025 05:24:09 UTC
The branch main has been updated by yasu:
URL: https://cgit.FreeBSD.org/ports/commit/?id=aefdc1ec77ef09b119d9801f2363e1653720bb38
commit aefdc1ec77ef09b119d9801f2363e1653720bb38
Author: Yasuhiro Kimura <yasu@FreeBSD.org>
AuthorDate: 2025-01-10 05:20:05 +0000
Commit: Yasuhiro Kimura <yasu@FreeBSD.org>
CommitDate: 2025-01-10 05:23:35 +0000
security/vuxml: Document two valnerabilities in redis and valkey
While here, update copyright year
---
security/vuxml/vuln.xml | 2 +-
security/vuxml/vuln/2025.xml | 82 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 83 insertions(+), 1 deletion(-)
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
index ba7314a9e226..f5af9b864a2a 100644
--- a/security/vuxml/vuln.xml
+++ b/security/vuxml/vuln.xml
@@ -25,7 +25,7 @@
<!ENTITY vuln-2025 SYSTEM "vuln/2025.xml">
]>
<!--
-Copyright 2003-2024 Jacques Vidrine and contributors
+Copyright 2003-2025 Jacques Vidrine and contributors
Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
HTML, PDF, PostScript, RTF and so forth) with or without modification,
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index 5588926228b8..f4e44f9d9f30 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,85 @@
+ <vuln vid="4d79fd1a-cc93-11ef-abed-08002784c58d">
+ <topic>redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors</topic>
+ <affects>
+ <package>
+ <name>redis</name>
+ <range><ge>7.0.0</ge><lt>7.4.2</lt></range>
+ </package>
+ <package>
+ <name>redis72</name>
+ <range><lt>7.2.7</lt></range>
+ </package>
+ <package>
+ <name>valkey</name>
+ <range><lt>8.0.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Redis core team reports:</p>
+ <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9">
+ <p>
+ An authenticated with sufficient privileges may create a
+ malformed ACL selector which, when accessed, triggers a
+ server panic and subsequent denial of service.The problem
+ exists in Redis 7.0.0 or newer.
+ </p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2024-51741</cvename>
+ <url>https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9</url>
+ </references>
+ <dates>
+ <discovery>2025-01-06</discovery>
+ <entry>2025-01-10</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="5f19ac58-cc90-11ef-abed-08002784c58d">
+ <topic>redis,valkey -- Remote code execution valnerability</topic>
+ <affects>
+ <package>
+ <name>redis</name>
+ <range><lt>7.4.2</lt></range>
+ </package>
+ <package>
+ <name>redis72</name>
+ <range><lt>7.2.7</lt></range>
+ </package>
+ <package>
+ <name>redis62</name>
+ <range><lt>6.2.17</lt></range>
+ </package>
+ <package>
+ <name>valkey</name>
+ <range><lt>8.0.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Redis core team reports:</p>
+ <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c">
+ <p>
+ An authenticated user may use a specially crafted Lua
+ script to manipulate the garbage collector and potentially
+ lead to remote code execution. The problem exists in all
+ versions of Redis with Lua scripting.
+ </p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2024-46981</cvename>
+ <url>https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c</url>
+ </references>
+ <dates>
+ <discovery>2025-01-06</discovery>
+ <entry>2025-01-10</entry>
+ </dates>
+ </vuln>
+
<vuln vid="2bfde261-cdf2-11ef-b6b2-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>