diff options
| author | Yasuhiro Kimura <yasu@FreeBSD.org> | 2025-01-10 05:20:05 +0000 |
|---|---|---|
| committer | Yasuhiro Kimura <yasu@FreeBSD.org> | 2025-01-10 05:23:35 +0000 |
| commit | aefdc1ec77ef09b119d9801f2363e1653720bb38 (patch) | |
| tree | 572fe246f092cc56e53b99772661b72d9a22503e | |
| parent | b8f947f8743801ecb569bdc8a9ddea1bea96fbd5 (diff) | |
security/vuxml: Document two valnerabilities in redis and valkey
While here, update copyright year
| -rw-r--r-- | security/vuxml/vuln.xml | 2 | ||||
| -rw-r--r-- | security/vuxml/vuln/2025.xml | 82 |
2 files changed, 83 insertions, 1 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index ba7314a9e226..f5af9b864a2a 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -25,7 +25,7 @@ <!ENTITY vuln-2025 SYSTEM "vuln/2025.xml"> ]> <!-- -Copyright 2003-2024 Jacques Vidrine and contributors +Copyright 2003-2025 Jacques Vidrine and contributors Redistribution and use in source (VuXML) and 'compiled' forms (SGML, HTML, PDF, PostScript, RTF and so forth) with or without modification, diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 5588926228b8..f4e44f9d9f30 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,85 @@ + <vuln vid="4d79fd1a-cc93-11ef-abed-08002784c58d"> + <topic>redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors</topic> + <affects> + <package> + <name>redis</name> + <range><ge>7.0.0</ge><lt>7.4.2</lt></range> + </package> + <package> + <name>redis72</name> + <range><lt>7.2.7</lt></range> + </package> + <package> + <name>valkey</name> + <range><lt>8.0.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Redis core team reports:</p> + <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9"> + <p> + An authenticated with sufficient privileges may create a + malformed ACL selector which, when accessed, triggers a + server panic and subsequent denial of service.The problem + exists in Redis 7.0.0 or newer. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-51741</cvename> + <url>https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9</url> + </references> + <dates> + <discovery>2025-01-06</discovery> + <entry>2025-01-10</entry> + </dates> + </vuln> + + <vuln vid="5f19ac58-cc90-11ef-abed-08002784c58d"> + <topic>redis,valkey -- Remote code execution valnerability</topic> + <affects> + <package> + <name>redis</name> + <range><lt>7.4.2</lt></range> + </package> + <package> + <name>redis72</name> + <range><lt>7.2.7</lt></range> + </package> + <package> + <name>redis62</name> + <range><lt>6.2.17</lt></range> + </package> + <package> + <name>valkey</name> + <range><lt>8.0.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Redis core team reports:</p> + <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c"> + <p> + An authenticated user may use a specially crafted Lua + script to manipulate the garbage collector and potentially + lead to remote code execution. The problem exists in all + versions of Redis with Lua scripting. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-46981</cvename> + <url>https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c</url> + </references> + <dates> + <discovery>2025-01-06</discovery> + <entry>2025-01-10</entry> + </dates> + </vuln> + <vuln vid="2bfde261-cdf2-11ef-b6b2-2cf05da270f3"> <topic>Gitlab -- Vulnerabilities</topic> <affects> |