From 13163e123a059e45c86ee99c420e69986404a854 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Thu, 6 Nov 2025 06:35:11 +0000 Subject: [PATCH] import OL valkey-8.0.6-1.0.1.el10_0 --- .gitignore | 2 +- 1000-CVE-2025-49844.patch | 36 ++++++++++++++++++++++++++++++++++++ sources | 2 +- valkey.spec | 11 +++++++++-- 4 files changed, 47 insertions(+), 4 deletions(-) create mode 100644 1000-CVE-2025-49844.patch diff --git a/.gitignore b/.gitignore index d2c6350..531f909 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -valkey-8.0.4.tar.gz +valkey-8.0.6.tar.gz diff --git a/1000-CVE-2025-49844.patch b/1000-CVE-2025-49844.patch new file mode 100644 index 0000000..ececa27 --- /dev/null +++ b/1000-CVE-2025-49844.patch @@ -0,0 +1,36 @@ +From d5728cb5795c966c5b5b1e0f0ac576a7e69af539 Mon Sep 17 00:00:00 2001 +From: Mincho Paskalev +Date: Mon, 23 Jun 2025 11:41:37 +0300 +Subject: [PATCH] Lua script may lead to remote code execution (CVE-2025-49844) + +Orabug: 38515582 + +Signed-off-by: Laurence Rochfort +Reviewed-by: Alex Burmashev +--- + deps/lua/src/lparser.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/deps/lua/src/lparser.c b/deps/lua/src/lparser.c +index dda7488dcad..ee7d90c90d7 100644 +--- a/deps/lua/src/lparser.c ++++ b/deps/lua/src/lparser.c +@@ -384,13 +384,17 @@ Proto *luaY_parser (lua_State *L, ZIO *z, Mbuffer *buff, const char *name) { + struct LexState lexstate; + struct FuncState funcstate; + lexstate.buff = buff; +- luaX_setinput(L, &lexstate, z, luaS_new(L, name)); ++ TString *tname = luaS_new(L, name); ++ setsvalue2s(L, L->top, tname); ++ incr_top(L); ++ luaX_setinput(L, &lexstate, z, tname); + open_func(&lexstate, &funcstate); + funcstate.f->is_vararg = VARARG_ISVARARG; /* main func. is always vararg */ + luaX_next(&lexstate); /* read first token */ + chunk(&lexstate); + check(&lexstate, TK_EOS); + close_func(&lexstate); ++ --L->top; + lua_assert(funcstate.prev == NULL); + lua_assert(funcstate.f->nups == 0); + lua_assert(lexstate.fs == NULL); diff --git a/sources b/sources index c1b2af6..4fa0d30 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (valkey-8.0.4.tar.gz) = 2e6969a2c791f39943fe31c9c6dc5432accc37212c586f891f997df6dc74c0329d9f7254c54842f8203c8427f903e016cd465747d221349396327649ffa340fb +SHA512 (valkey-8.0.6.tar.gz) = 0f704ad06abab2817657abe60be6fb7c45df91cdaaa53d921e26c6f4e91a3712152a31550b876d8deba3493a6ca4b87194efd3a86cacd53906f01e845e7cb137 diff --git a/valkey.spec b/valkey.spec index f1bc62c..b3e993e 100644 --- a/valkey.spec +++ b/valkey.spec @@ -2,8 +2,8 @@ %bcond_with tests Name: valkey -Version: 8.0.4 -Release: 1%{?dist} +Version: 8.0.6 +Release: 1.0.1%{?dist} Summary: A persistent key-value database # valkey: BSD-3-Clause # hiredis: BSD-3-Clause @@ -21,6 +21,7 @@ Source8: macros.%{name} Source9: migrate_redis_to_valkey.sh Patch1: valkey-cve-2025-27151.patch +Patch1000: 1000-CVE-2025-49844.patch BuildRequires: make BuildRequires: gcc @@ -263,6 +264,12 @@ taskset -c 1 ./runtest --clients 50 --skiptest "Active defrag - AOF loading" %changelog +* Wed Nov 05 2025 EL Errata - 8.0.6-1.0.1 +- Fix for CVE-2025-49844 [Orabug: 38515582] + +* Tue Oct 7 2025 Remi Collet - 8.0.6-1 +- rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 + * Wed Jul 16 2025 Remi Collet - 8.0.4-1 - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023