Your message dated Tue, 15 Jul 2025 09:34:03 -0700 with message-id <[email protected]> and subject line Re: Bug#1106822: redis: CVE-2025-27151 has caused the Debian Bug report #1106822, regarding redis: CVE-2025-27151 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 1106822: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1106822 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Source: redis Version: 5:8.0.0-2 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Control: found -1 5:7.0.15-3 Control: found -1 5:7.0.15-1 Hi, The following vulnerability was published for redis. CVE-2025-27151[0]: | Redis is an open source, in-memory database that persists on disk. | In versions starting from 7.0.0 to before 8.0.2, a stack-based | buffer overflow exists in redis-check-aof due to the use of memcpy | with strlen(filepath) when copying a user-supplied file path into a | fixed-size stack buffer. This allows an attacker to overflow the | stack and potentially achieve code execution. This issue has been | patched in version 8.0.2. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-27151 https://www.cve.org/CVERecord?id=CVE-2025-27151 [1] https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm Regards, Salvatore
--- End Message ---
--- Begin Message ---Version: 5:8.0.2-1 Hi Paul, > The upload of 8.0.2 already happened, but this bug isn't closed. I > assume that's just an oversight? Yes. When preparing the actual upload, I did not pass -v to dpkg-genchanges, so the .changes file did not specify this bug number in the Closes entry. I can confirm that this CVE is fixed, so closing manually here. Regards, -- ,''`. : :' : Chris Lamb `. `'` [email protected] 🍥 chris-lamb.co.uk `-
--- End Message ---
