Catalog / Redis

8.2.8

2 months agosecurityfixedOriginal notes

SECURITY: There are security fixes in the release.

Security fixes

  • A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
  • RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

  • RedisBloom/RedisBloom#1019 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover