redis (5:6.0.16-1ubuntu1) jammy; urgency=medium

  * SECURITY UPDATE: Lua sandbox escape
    - debian/rules: Ensure arbitrary Lua functionality is not permitted by
      specifying a nil package
    - CVE-2022-0543

 -- Alex Murray <alex.murray@canonical.com>  Fri, 04 Mar 2022 15:44:35 +1030

redis (5:6.0.16-1build1) jammy; urgency=medium

  * No-change rebuild against libssl3

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 09 Dec 2021 00:16:26 +0000

redis (5:6.0.16-1) unstable; urgency=medium

  * New upstream security release:

    - CVE-2021-32762: Integer to heap buffer overflow issue in redis-cli and
      redis-sentinel parsing large multi-bulk replies on some older and less
      common platforms.

    - CVE-2021-32687: Integer to heap buffer overflow with intsets, when
      set-max-intset-entries is manually configured to a non-default, very
      large value.

    - CVE-2021-32675: Denial Of Service when processing RESP request payloads
      with a large number of elements on many connections.

    - CVE-2021-32672: Random heap reading issue with Lua Debugger.

    - CVE-2021-32628: Integer to heap buffer overflow handling ziplist-encoded
      data types, when configuring a large, non-default value for
      hash-max-ziplist-entries, hash-max-ziplist-value,
      zset-max-ziplist-entries or zset-max-ziplist-value.

    - CVE-2021-32627: Integer to heap buffer overflow issue with streams, when
      configuring a non-default, large value for proto-max-bulk-len and
      client-query-buffer-limit.

    - CVE-2021-32626: Specially crafted Lua scripts may result with Heap
      buffer overflow.

    - CVE-2021-41099: Integer to heap buffer overflow handling certain string
      commands and network payloads, when proto-max-bulk-len is manually
      configured to a non-default, very large value.

  * Refresh patches.
  * Bump Standards-Version to 4.6.0.

 -- Chris Lamb <lamby@debian.org>  Mon, 04 Oct 2021 14:37:24 +0100

redis (5:6.0.15-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2021-32761: Integer overflow issues with BITFIELD command
      on 32-bit systems.
  * Bump Standards-Version to 4.5.1.

 -- Chris Lamb <lamby@debian.org>  Wed, 21 Jul 2021 22:21:54 +0100

redis (5:6.0.14-1) unstable; urgency=medium

  * CVE-2021-32625: Fix a vulnerability in the STRALGO LCS command.
    (Closes: #989351)

 -- Chris Lamb <lamby@debian.org>  Tue, 01 Jun 2021 17:35:19 +0100

redis (5:6.0.13-1) unstable; urgency=medium

  * New upstream security release:
    - CVE-2021-29477: Vulnerability in the STRALGO LCS command.
    - CVE-2021-29478: Vulnerability in the COPY command for large intsets.
    (Closes: #988045)
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 04 May 2021 11:06:14 +0100

redis (5:6.0.12-1) unstable; urgency=medium

  * New upstream release.

 -- Chris Lamb <lamby@debian.org>  Sat, 06 Mar 2021 11:03:47 +0000

redis (5:6.0.11-1) unstable; urgency=medium

  * New upstream release, incorporating security issues. (Closes: #983446)
    - Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 24 Feb 2021 11:05:06 +0000

redis (5:6.0.10-4) unstable; urgency=medium

  * New upstream release
    - Fix cluster access to unaligned memory on ARM architectures with hard
      alignment requirements such as armhf and arm64. (Closes: #982504)
  * wrap-and-sort -sa.

 -- Chris Lamb <lamby@debian.org>  Thu, 11 Feb 2021 14:49:41 +0000

redis (5:6.0.9-4) unstable; urgency=medium

  * Send systemd readiness notification when we are ready to accept connections
    in order to fix systemd integration when Redis is used with replicaof.
    Thanks to Guillem Jover for the report and patch. (Closes: #981226)

 -- Chris Lamb <lamby@debian.org>  Thu, 28 Jan 2021 10:12:06 +0000

# For older changelog entries, run 'apt-get changelog redis-tools'
