Redis 8.2.8

8.2.8
Fixed 1
  • Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover
Security 2
  • Fix a crafted stream RESTORE payload that could make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
  • Fix crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution

From Redis

SECURITY: There are security fixes in the release.

Security fixes
  • A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
  • RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
Bug fixes
  • RedisBloom/RedisBloom#1019 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover
View original

Upgraded? How did it go?

Discussion