Debian Patches

Status for valkey/8.1.1+dfsg1-3

Patch Description Author Forwarded Bugs Origin Last update
debian-packaging/0001-Set-Debian-configuration-defaults.patch Set Debian configuration defaults Chris Lamb <lamby@debian.org> no 2025-04-28
0001-Fix-FTBFS-on-kFreeBSD.patch Fix FTBFS on kFreeBSD Chris Lamb <lamby@debian.org> no 2015-10-30
0002-Add-CPPFLAGS-to-upstream-makefiles.patch Add CPPFLAGS to upstream makefiles Chris Lamb <lamby@debian.org> no 2015-10-30
0003-Use-get_current_dir_name-over-PATHMAX.patch Use get_current_dir_name over PATHMAX, etc. Chris Lamb <lamby@debian.org> no 2024-10-29
0004-Add-support-for-USE_SYSTEM_JEMALLOC-flag.patch Add support for USE_SYSTEM_JEMALLOC flag. Chris Lamb <lamby@debian.org> no 2025-04-28
0005-Incorporate-Redis-CVE-for-CVE-2025-27151-2146.patch Incorporate Redis CVE for CVE-2025-27151 (#2146)
Resolves https://github.com/valkey-io/valkey/issues/2145

Incorporate the CVE patch that was sent to us by Redis Ltd.		 Madelyn Olson <madelyneolson@gmail.com> no debian https://github.com/valkey-io/valkey/commit/73696bf6e2cf754acc3ec24eaf9ca6b879bfc5d7 2025-05-29
CVE-2025-49112.patch Fix unsigned difference expression compared to zero (#2101)
https://github.com/valkey-io/valkey/blob/daea05b1e26db29bfd1c033e27f9d519a2f8ccbb/src/networking.c#L886-L886

Fix the issue need to ensure that the subtraction `prev->size -
prev->used` does not underflow. This can be achieved by explicitly
checking that `prev->used` is less than `prev->size` before performing
the subtraction. This approach avoids relying on unsigned arithmetic and
ensures the logic is clear and robust.

The specific changes are:
1. Replace the condition `prev->size - prev->used > 0` with `prev->used
< prev->size`.
2. This change ensures that the logic checks whether there is remaining
space in the buffer without risking underflow.

**References**
[INT02-C. Understand integer conversion
rules](https://wiki.sei.cmu.edu/confluence/display/c/INT02-C.+Understand+integer+conversion+rules)
[CWE-191](https://cwe.mitre.org/data/definitions/191.html)		 Zeroday BYTE <github@zerodaysec.org> no 2025-05-26
CVE-2025-32023.patch Apply fixed for CVE-2025-32023 (#2314) Ran Shidlansik <ranshid@amazon.com> no debian upstream, https://github.com/valkey-io/valkey/commit/20f5199d96b 2025-07-06
CVE-2025-48367.patch retry accept on transient errors (CVE-2025-48367) (#2315) Ran Shidlansik <ranshid@amazon.com> no debian upstream, https://github.com/valkey-io/valkey/commit/cb10d9d78f3594 2025-07-07

All known versions for source package 'valkey'

Links