import OL valkey-8.0.6-1.0.1.el10_0

.gitignore

@@ -1 +1 @@
-valkey-8.0.4.tar.gz
+valkey-8.0.6.tar.gz

1000-CVE-2025-49844.patch

@@ -0,0 +1,36 @@
+From d5728cb5795c966c5b5b1e0f0ac576a7e69af539 Mon Sep 17 00:00:00 2001
+From: Mincho Paskalev <minchopaskal@gmail.com>
+Date: Mon, 23 Jun 2025 11:41:37 +0300
+Subject: [PATCH] Lua script may lead to remote code execution (CVE-2025-49844)
+
+Orabug: 38515582
+
+Signed-off-by: Laurence Rochfort <laurence.rochfort@oracle.com>
+Reviewed-by: Alex Burmashev <alexander.burmashev@oracle.com>
+---
+ deps/lua/src/lparser.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/deps/lua/src/lparser.c b/deps/lua/src/lparser.c
+index dda7488dcad..ee7d90c90d7 100644
+--- a/deps/lua/src/lparser.c
++++ b/deps/lua/src/lparser.c
+@@ -384,13 +384,17 @@ Proto *luaY_parser (lua_State *L, ZIO *z, Mbuffer *buff, const char *name) {
+   struct LexState lexstate;
+   struct FuncState funcstate;
+   lexstate.buff = buff;
+-  luaX_setinput(L, &lexstate, z, luaS_new(L, name));
++  TString *tname = luaS_new(L, name);
++  setsvalue2s(L, L->top, tname);
++  incr_top(L);
++  luaX_setinput(L, &lexstate, z, tname);
+   open_func(&lexstate, &funcstate);
+   funcstate.f->is_vararg = VARARG_ISVARARG;  /* main func. is always vararg */
+   luaX_next(&lexstate);  /* read first token */
+   chunk(&lexstate);
+   check(&lexstate, TK_EOS);
+   close_func(&lexstate);
++  --L->top;
+   lua_assert(funcstate.prev == NULL);
+   lua_assert(funcstate.f->nups == 0);
+   lua_assert(lexstate.fs == NULL);

sources

@@ -1 +1 @@
-SHA512 (valkey-8.0.4.tar.gz) = 2e6969a2c791f39943fe31c9c6dc5432accc37212c586f891f997df6dc74c0329d9f7254c54842f8203c8427f903e016cd465747d221349396327649ffa340fb
+SHA512 (valkey-8.0.6.tar.gz) = 0f704ad06abab2817657abe60be6fb7c45df91cdaaa53d921e26c6f4e91a3712152a31550b876d8deba3493a6ca4b87194efd3a86cacd53906f01e845e7cb137

valkey.spec

@@ -2,8 +2,8 @@
 %bcond_with tests
 
 Name:              valkey
-Version:           8.0.4
-Release:           1%{?dist}
+Version:           8.0.6
+Release:           1.0.1%{?dist}
 Summary:           A persistent key-value database
 # valkey: BSD-3-Clause
 # hiredis: BSD-3-Clause
@@ -21,6 +21,7 @@ Source8:           macros.%{name}
 Source9:           migrate_redis_to_valkey.sh
 
 Patch1:            valkey-cve-2025-27151.patch
+Patch1000:         1000-CVE-2025-49844.patch
 
 BuildRequires:     make
 BuildRequires:     gcc
@@ -263,6 +264,12 @@ taskset -c 1 ./runtest --clients 50 --skiptest "Active defrag - AOF loading"
 
 
 %changelog
+* Wed Nov 05 2025 EL Errata <el-errata_ww@oracle.com> - 8.0.6-1.0.1
+- Fix for CVE-2025-49844 [Orabug: 38515582]
+
+* Tue Oct  7 2025 Remi Collet <remi@fedoraproject.org> - 8.0.6-1
+- rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819
+
 * Wed Jul 16 2025 Remi Collet <remi@fedoraproject.org> - 8.0.4-1
 - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023