redis (5:6.0.16-1ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2025-49844.patch: protect TString on stack
      during parsing to prevent use-after-free condition in lparser.c
    - CVE-2025-49844

 -- Sudhakar Verma <sudhakar.verma@canonical.com>  Mon, 13 Oct 2025 22:00:59 +0530

redis (5:6.0.16-1ubuntu1) jammy; urgency=medium

  * SECURITY UPDATE: Lua sandbox escape
    - debian/rules: Ensure arbitrary Lua functionality is not permitted by
      specifying a nil package
    - CVE-2022-0543

 -- Alex Murray <alex.murray@canonical.com>  Fri, 04 Mar 2022 15:44:35 +1030

redis (5:6.0.16-1build1) jammy; urgency=medium

  * No-change rebuild against libssl3

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 09 Dec 2021 00:16:26 +0000

redis (5:6.0.16-1) unstable; urgency=medium

  * New upstream security release:

    - CVE-2021-32762: Integer to heap buffer overflow issue in redis-cli and
      redis-sentinel parsing large multi-bulk replies on some older and less
      common platforms.

    - CVE-2021-32687: Integer to heap buffer overflow with intsets, when
      set-max-intset-entries is manually configured to a non-default, very
      large value.

    - CVE-2021-32675: Denial Of Service when processing RESP request payloads
      with a large number of elements on many connections.

    - CVE-2021-32672: Random heap reading issue with Lua Debugger.

    - CVE-2021-32628: Integer to heap buffer overflow handling ziplist-encoded
      data types, when configuring a large, non-default value for
      hash-max-ziplist-entries, hash-max-ziplist-value,
      zset-max-ziplist-entries or zset-max-ziplist-value.

    - CVE-2021-32627: Integer to heap buffer overflow issue with streams, when
      configuring a non-default, large value for proto-max-bulk-len and
      client-query-buffer-limit.

    - CVE-2021-32626: Specially crafted Lua scripts may result with Heap
      buffer overflow.

    - CVE-2021-41099: Integer to heap buffer overflow handling certain string
      commands and network payloads, when proto-max-bulk-len is manually
      configured to a non-default, very large value.

  * Refresh patches.
  * Bump Standards-Version to 4.6.0.

 -- Chris Lamb <lamby@debian.org>  Mon, 04 Oct 2021 14:37:24 +0100

redis (5:6.0.15-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2021-32761: Integer overflow issues with BITFIELD command
      on 32-bit systems.
  * Bump Standards-Version to 4.5.1.

 -- Chris Lamb <lamby@debian.org>  Wed, 21 Jul 2021 22:21:54 +0100

redis (5:6.0.14-1) unstable; urgency=medium

  * CVE-2021-32625: Fix a vulnerability in the STRALGO LCS command.
    (Closes: #989351)

 -- Chris Lamb <lamby@debian.org>  Tue, 01 Jun 2021 17:35:19 +0100

redis (5:6.0.13-1) unstable; urgency=medium

  * New upstream security release:
    - CVE-2021-29477: Vulnerability in the STRALGO LCS command.
    - CVE-2021-29478: Vulnerability in the COPY command for large intsets.
    (Closes: #988045)
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 04 May 2021 11:06:14 +0100

redis (5:6.0.12-1) unstable; urgency=medium

  * New upstream release.

 -- Chris Lamb <lamby@debian.org>  Sat, 06 Mar 2021 11:03:47 +0000

redis (5:6.0.11-1) unstable; urgency=medium

  * New upstream release, incorporating security issues. (Closes: #983446)
    - Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 24 Feb 2021 11:05:06 +0000

redis (5:6.0.10-4) unstable; urgency=medium

  * New upstream release
    - Fix cluster access to unaligned memory on ARM architectures with hard
      alignment requirements such as armhf and arm64. (Closes: #982504)
  * wrap-and-sort -sa.

 -- Chris Lamb <lamby@debian.org>  Thu, 11 Feb 2021 14:49:41 +0000

# For older changelog entries, run 'apt-get changelog redis-tools'
