Accepting request 896855 from home:AndreasStieger:branches:server:database

redis 6.2.4 CVE-2021-32625 (boo#1186722)

OBS-URL: https://build.opensuse.org/request/show/896855
OBS-URL: https://build.opensuse.org/package/show/server:database/redis?expand=0&rev=181

redis-6.2.3.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:98ed7d532b5e9671f5df0825bb71f0f37483a16546364049384c63db8764512b
-size 2456050

redis-6.2.4.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ba32c406a10fc2c09426e2be2787d74ff204eb3a2e496d87cff76a476b6ae16e
+size 2457940

redis.changes

@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Wed Jun  2 07:57:17 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- redis 6.2.4:
+  * CVE-2021-32625: An integer overflow bug could be exploited by
+    using the STRALGO LCS command to cause remote remote code
+    execution (boo#1186722)
+  * Fix crash after a diskless replication fork child is terminated
+  * Fix redis-benchmark crash on unsupported configs
+  * Fix crash in UNLINK on a stream key with deleted consumer groups
+  * SINTERSTORE: Add missing keyspace del event when none of the
+    sources exist
+  * Sentinel: Fix CONFIG SET of empty string
+    sentinel-user/sentinel-pass configs
+  * Enforce client output buffer soft limit when no traffic
+  * Hide AUTH passwords in MIGRATE command from slowlog
+
 -------------------------------------------------------------------
 Fri May 21 20:30:15 UTC 2021 - Jan Engelhardt <jengelh@inai.de>
 

redis.hashes

@@ -125,3 +125,5 @@ hash redis-6.2.1.tar.gz sha256 cd222505012cce20b25682fca931ec93bd21ae92cb4abfe74
 hash redis-6.2.2.tar.gz sha256 7a260bb74860f1b88c3d5942bf8ba60ca59f121c6dce42d3017bed6add0b9535 http://download.redis.io/releases/redis-6.2.2.tar.gz
 hash redis-6.0.13.tar.gz sha256 3049763f4553ddd5a69552f41da3dd7dde9fbc524dbb15e517fee24cc73b790c http://download.redis.io/releases/redis-6.0.13.tar.gz
 hash redis-6.2.3.tar.gz sha256 98ed7d532b5e9671f5df0825bb71f0f37483a16546364049384c63db8764512b http://download.redis.io/releases/redis-6.2.3.tar.gz
+hash redis-6.0.14.tar.gz sha256 c3e60c928b183ca9fe8e878936a6f8ba99e0441b9b6e04d2412a750ea576c649 http://download.redis.io/releases/redis-6.0.14.tar.gz
+hash redis-6.2.4.tar.gz sha256 ba32c406a10fc2c09426e2be2787d74ff204eb3a2e496d87cff76a476b6ae16e http://download.redis.io/releases/redis-6.2.4.tar.gz

redis.spec

@@ -20,7 +20,7 @@
 %define _log_dir        %{_localstatedir}/log/%{name}
 %define _conf_dir       %{_sysconfdir}/%{name}
 Name:           redis
-Version:        6.2.3
+Version:        6.2.4
 Release:        0
 Summary:        Persistent key-value database
 License:        BSD-3-Clause