Skip to content

5.0.11
Compare
Choose a tag to compare
@oranagra oranagra released this 22 Feb 21:34
· 14 commits to 5.0 since this release
5.0.11
562787e

Upgrade urgency: SECURITY if you use 32bit build of redis (see bellow), LOW
otherwise.

Integer overflow on 32-bit systems (CVE-2021-21309):
Redis 4.0 or newer uses a configurable limit for the maximum supported bulk
input size. By default, it is 512MB which is a safe value for all platforms.
If the limit is significantly increased, receiving a large request from a client
may trigger several integer overflow scenarios, which would result with buffer
overflow and heap corruption.

Bug fixes:

  • Avoid 32-bit overflows when proto-max-bulk-len is set high (#8522)
  • Fix an issue where a forked process deletes the parent's pidfile (#8231)
  • Fix flock cluster config may cause failure to restart after kill -9 (#7674)
  • Avoid an out-of-bounds read in the redis-sentinel (#7443)

Platform and deployment-related changes:

  • Fix setproctitle related crashes. (#8150, #8088)
    Caused various crashes on startup, mainly on Apple M1 chips or under
    instrumentation.
  • Add a check for an ARM64 Linux kernel bug (#8224)
    Due to the potential severity of this issue, Redis will refuse to run on
    affected platforms by default.

Modules:

  • RM_ZsetRem: Delete key if empty, the bug could leave empty zset keys (#8453)
Assets 2