Security8.4.7
Redis 8.4.7 Security Release
This security release fixes multiple vulnerabilities including ACL permission bypass in transactions, unauthenticated cluster bus access, and crashes in TimeSeries and Vector Sets modules. Updates are strongly recommended for all users.
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- #15722 The cluster bus protocol has no authentication of its own unless
tls-clusteris enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the newcluster-bus-port-protected-modeoption (defaultno) makes refusing to run in that state an explicit choice: set it toyesand the node starts only whentls-clusterauthenticates the bus - TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
securityaclclustertimeseriesvector-sets
Source: original entry ↗