Описание
Security update for valkey
This update for valkey fixes the following issues
- CVE-2025-67733: data tampering and denial of service via improper null character handling in Lua scripts (bsc#1258746).
- CVE-2026-21863: denial of service via invalid clusterbus packet (bsc#1258788).
- CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).
- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165).
- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).
Changes for valkey:
-
Update to 8.0.9.
-
Update to 8.0.7:
- Fix ltrim should not call signalModifiedKey when no elements are removed (#2787)
- Fix chained replica crash when doing dual channel replication (#2983)
- Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
- Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
- Fix server assert on ACL LOAD and resetchannels (#3182)
- Fix bug causing no response flush sometimes when IO threads are busy (#3205)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1258746
- SUSE Bug 1258788
- SUSE Bug 1264164
- SUSE Bug 1264165
- SUSE Bug 1264166
- SUSE CVE CVE-2025-67733 page
- SUSE CVE CVE-2026-21863 page
- SUSE CVE CVE-2026-23479 page
- SUSE CVE CVE-2026-23631 page
- SUSE CVE CVE-2026-25243 page
Описание
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Затронутые продукты
Ссылки
- CVE-2025-67733
- SUSE Bug 1258746
Описание
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.
Затронутые продукты
Ссылки
- CVE-2026-21863
- SUSE Bug 1258788
Описание
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Затронутые продукты
Ссылки
- CVE-2026-23479
- SUSE Bug 1264164
Описание
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
Затронутые продукты
Ссылки
- CVE-2026-23631
- SUSE Bug 1264165
Описание
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
Затронутые продукты
Ссылки
- CVE-2026-25243
- SUSE Bug 1264166