redis (2:3.0.6-1ubuntu0.4) xenial-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflows in Hyperloglog (Closes: #1836496)
    - debian/patches/CVE-2019-10192.patch: Fix hyperloglog corruption
    - CVE-2019-10192

 -- Julian Andres Klode <juliank@ubuntu.com>  Sun, 14 Jul 2019 21:21:22 +0200

redis (2:3.0.6-1ubuntu0.3) xenial-security; urgency=medium

  * SECURITY UPDATE: Tighten Permissions
    - Ensure /var/lib/redis and /var/log/redis are not world readable
    - Set UMask=007 in redis-server.service, redis-sentinel.server
    - Changes taken from Debian version 3:3.2.5-2
    - CVE-2016-2121

 -- Mike Salvatore <mike.salvatore@canonical.com>  Fri, 07 Dec 2018 11:02:30 -0500

redis (2:3.0.6-1ubuntu0.2) xenial-security; urgency=medium

  * SECURITY UPDATE: Permissions issue
    - debian/patches/CVE-2013-7458.patch: fix in
      deps/linenoise/linenoise.c.
    - CVE-2013-7458
  * SECURITY UPDATE: Cross protocol scripting
    - debian/patches/CVE-2016-10517.patch: fix in
      src/redis.c, src/redis.h.
    - CVE-2016-10517
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2017-15047.patch: fix in
      src/cluster.c.
    - CVE-2017-15047
  * SECURITY UPDATE: Memory corruption
    - debian/patches/CVE-2018-11218.patch: fix in
      deps/lua/src/lua_cmsgpack.c.
    - CVE-2018-11218
  * SECURITY UPDATE: Integer Overflow
    - debian/patches/CVE-2018-11219-*.patch: fix in
      deps/lua/src/lua_struct.c.
    - CVE-2018-11219
  * SECURITY UPDATE: Buffer overflow in the redis-cli
    - debian/patches/CVE-2018-12326.patch: fix in
      redis-cli.c.
    - CVE-2018-12326

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Tue, 26 Jun 2018 17:12:39 -0300

redis (2:3.0.6-1) unstable; urgency=medium

  * New upstream release.
  * Drop 06-CVE-2015-8080-Integer-wraparound-in-lua_struct.c-cau.patch as an
    equivalent change merged upstream.
  * Don't fail if redis user already exists. (Closes: #774736)

 -- Chris Lamb <lamby@debian.org>  Sat, 19 Dec 2015 11:27:41 +0000

redis (2:3.0.5-4) unstable; urgency=high

  * CVE-2015-8080: Integer wraparound in lua_struct.c causing stack-based
    buffer overflow (Closes: #804419)
  * Correct call to /bin/kill in redis-{server,sentinel}.service to avoid
    "kill: invalid argument T" messages when $MAINPID is not set.

 -- Chris Lamb <lamby@debian.org>  Sat, 21 Nov 2015 16:22:45 +0200

redis (2:3.0.5-3) unstable; urgency=medium

  * Add a redis-sentinel.tmpfile matching redis-server.tmpfile.
  * wrap-and-sort -sa
  * Rebase all patches with `gbp pq`.

 -- Chris Lamb <lamby@debian.org>  Fri, 30 Oct 2015 10:54:30 +0000

redis (2:3.0.5-2) unstable; urgency=medium

  * Also specify `ProtectSystem=true` over `ProtectSystem=full` in
    redis-server.service so that it can write its own configuration file
    when being run in cluster mode. (Closes: #803366)

 -- Chris Lamb <lamby@debian.org>  Fri, 30 Oct 2015 00:01:17 +0000

redis (2:3.0.5-1) unstable; urgency=medium

  * New upstream release.
    - Sync ./redis.conf and ./debian/redis.conf.

 -- Chris Lamb <lamby@debian.org>  Thu, 15 Oct 2015 16:12:17 +0100

redis (2:3.0.4-8) unstable; urgency=medium

  * Use `ProtectSystem=true` over `ProtectSystem=full` in
    redis-sentinel.service so that it can write its own configuration file
    under /etc. Thanks to Pete Hicks <jph@bebo.com> for the report and fix.
    (Closes: #799696)

 -- Chris Lamb <lamby@debian.org>  Tue, 13 Oct 2015 20:46:23 +0100

redis (2:3.0.4-7) unstable; urgency=medium

  * Change the default (and commented-out) value for "unixsocket" from
    /tmp/redis.sock -> /var/run/redis/redis.sock so that it will work even
    under systemd's PrivateTmp=True. Thanks to 
    Chris <Fisch.666@gmx.de> (Closes: #801464)

 -- Chris Lamb <lamby@debian.org>  Sat, 10 Oct 2015 21:11:57 +0200

# For older changelog entries, run 'apt-get changelog redis-tools'
