From nobody Mon Jul 10 16:32:33 2023 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4R08g56Q52z2trBs; Mon, 10 Jul 2023 16:32:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4R08g55vHdz3HSt; Mon, 10 Jul 2023 16:32:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1689006753; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RitFTf/0H2+a9yZ3bBj373xJCiEQfp5LyksEUWHVOiw=; b=ef/zjV9CUyFByzbVja6uQdVhd0XgEamC1t23pabVG6umOPbN6zS0zGjUodv0kRBF5aP8aM PQlJbi7FFGiKXR3yaN2qqFldFWdipdZ4Rj3A9YZ2dZuE5yMvtgrUEskgjnO7tczU4HjtXA nZQTRXgy0CGr/bejuKbdmLGFkSKkCB6lQxtgBpFrqlUbVV2Ek4CuqLP7/6m7hGxzx7+izp K83FE7tq+Ci0WPN66m0KLN0PC5eHWNoJybgWiwYNjIONLiZ6fkP1z1+cZ6+nPtSBgO6Fwt XHZVvXxBSdG0ftauNMh9qdYEcQkYx4IEh1lTpLU34EemJ1yB4pW66xBIxVeHVQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1689006753; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RitFTf/0H2+a9yZ3bBj373xJCiEQfp5LyksEUWHVOiw=; b=M1MaSb3P00pTnqB/Vw1Fd8qPrNhBi4Ue8fDnvvRHKPtinNviZOi9aQrmvLdTieylWjyiy4 xj6/1dqw5Q97vMlMHcn4Q79FSLMtaJ/sgOgt730f03Nb0n5p5pANcA6HIgiM69rNk833qA mKTQx4g4RmP4V9lwJQexGUuXb+wgpqKbKBoNIUBaZh8+ijuPqhlCfdtJEo/MlI9xxsFwdf b6wN9EWAwpkv9I+JhB12sFtxofb5/b619WEIKJRBmFkOXYQG0zTk2JzBoZvWPH/pSQwtZ7 5jsbZtKxBkpAuNc2eZ6UtzBvQ5OLa3QeRHIyW4kQ7hr7vdOYt4KFo4Do4NdwBw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1689006753; a=rsa-sha256; cv=none; b=hDQzp6UrA1GbKtF0p9l6CgWf/jb3/VXgCmhWvIP1VD42Sdvx1R8NO3PKZe5jNfdX/bg5xc xorHQwyN/AUWw6vIwKIRi+FGydVuKXg+3lhU1wppLG5FsAHMaAAgMXGFdgkmHYnqQ/ggR1 zMEgT5LDtHtsNMZp9fpWyM0qexRIk68FjOZ2I710O66fPmFepXvCr824eSxq60Bh+2bTqG 29iNKLd7aLfUO5kP/W76Pvii67VS+kq56wbwkpmv/CbkcwkARIk63akl3takSlo54Wbzq0 0s/llJNSYH5QY0XK0PnDHEZe15lqLDVjPVaigjnMR8Z8vROr8ia19kcm/Yo3xw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4R08g54yNMzs23; Mon, 10 Jul 2023 16:32:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 36AGWX09069059; Mon, 10 Jul 2023 16:32:33 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 36AGWXDA069058; Mon, 10 Jul 2023 16:32:33 GMT (envelope-from git) Date: Mon, 10 Jul 2023 16:32:33 GMT Message-Id: <202307101632.36AGWXDA069058@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Yasuhiro Kimura Subject: git: 1d28f4000a95 - main - security/vuxml: Document multiple vulnerabilities in redis List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: yasu X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1d28f4000a9537b41ec9915e20b1efc4a6468176 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by yasu: URL: https://cgit.FreeBSD.org/ports/commit/?id=1d28f4000a9537b41ec9915e20b1efc4a6468176 commit 1d28f4000a9537b41ec9915e20b1efc4a6468176 Author: Yasuhiro Kimura AuthorDate: 2023-07-10 15:51:17 +0000 Commit: Yasuhiro Kimura CommitDate: 2023-07-10 16:32:19 +0000 security/vuxml: Document multiple vulnerabilities in redis --- security/vuxml/vuln/2023.xml | 80 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index ca093c3ca668..c4535b40ca36 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,83 @@ + + redis -- heap overflow in COMMAND GETKEYS and ACL evaluation + + + redis + 7.0.12 + + + redis-devel + 7.0.12.20230710 + + + + +

Redis core team reports:

+
+

+ Extracting key names from a command and a list of + arguments may, in some cases, trigger a heap overflow and + result in reading random heap memory, heap corruption and + potentially remote code execution. Specifically: using + COMMAND GETKEYS* and validation of key names in ACL rules. +

+
+ + + + CVE-2023-36824 + https://groups.google.com/g/redis-db/c/JDjKS0GubsQ + https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3 + + + 2023-07-10 + 2023-07-10 + + + + + redis -- Heap overflow in the cjson and cmsgpack libraries + + + redis + 7.0.12 + + + redis-devel + 7.0.12.20230710 + + + redis62 + 6.2.13 + + + redis60 + 6.0.20 + + + + +

Redis core team reports:

+
+

+ A specially crafted Lua script executing in Redis can + trigger a heap overflow in the cjson and cmsgpack + libraries, and result in heap corruption and potentially + remote code execution. +

+
+ + + + CVE-2022-24834 + https://groups.google.com/g/redis-db/c/JDjKS0GubsQ + + + 2023-07-10 + 2023-07-10 + + + gitea -- avoid open HTTP redirects