Security8.2.10
Redis 8.2.10 — Security fixes
Security fixes for unauthenticated cluster bus protocol vulnerability, TimeSeries crash when processing compressed samples from malformed RDB, and Vector Sets crash from deeply nested JSON queries. The cluster-bus-port-protected-mode option is now available to enforce authentication requirements on the cluster bus port.
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- #15722 The cluster bus protocol has no authentication of its own unless
tls-clusteris enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the newcluster-bus-port-protected-modeoption (defaultno) makes refusing to run in that state an explicit choice: set it toyesand the node starts only whentls-clusterauthenticates the bus - TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
securityclustertimeseriesvector-setscrash-fix
Source: original entry ↗