Debian Patches
Status for valkey/8.1.1+dfsg1-3+deb13u3
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| debian-packaging/0001-Set-Debian-configuration-defaults.patch | Set Debian configuration defaults | Chris Lamb <lamby@debian.org> | no | 2025-04-28 | ||
| 0001-Fix-FTBFS-on-kFreeBSD.patch | Fix FTBFS on kFreeBSD | Chris Lamb <lamby@debian.org> | no | 2015-10-30 | ||
| 0002-Add-CPPFLAGS-to-upstream-makefiles.patch | Add CPPFLAGS to upstream makefiles | Chris Lamb <lamby@debian.org> | no | 2015-10-30 | ||
| 0003-Use-get_current_dir_name-over-PATHMAX.patch | Use get_current_dir_name over PATHMAX, etc. | Chris Lamb <lamby@debian.org> | no | 2024-10-29 | ||
| 0004-Add-support-for-USE_SYSTEM_JEMALLOC-flag.patch | Add support for USE_SYSTEM_JEMALLOC flag. | Chris Lamb <lamby@debian.org> | no | 2025-04-28 | ||
| 0005-Incorporate-Redis-CVE-for-CVE-2025-27151-2146.patch | Incorporate Redis CVE for CVE-2025-27151 (#2146) Resolves https://github.com/valkey-io/valkey/issues/2145 Incorporate the CVE patch that was sent to us by Redis Ltd. |
Madelyn Olson <madelyneolson@gmail.com> | no | debian | https://github.com/valkey-io/valkey/commit/73696bf6e2cf754acc3ec24eaf9ca6b879bfc5d7 | 2025-05-29 |
| CVE-2025-49112.patch | Fix unsigned difference expression compared to zero (#2101) https://github.com/valkey-io/valkey/blob/daea05b1e26db29bfd1c033e27f9d519a2f8ccbb/src/networking.c#L886-L886 Fix the issue need to ensure that the subtraction `prev->size - prev->used` does not underflow. This can be achieved by explicitly checking that `prev->used` is less than `prev->size` before performing the subtraction. This approach avoids relying on unsigned arithmetic and ensures the logic is clear and robust. The specific changes are: 1. Replace the condition `prev->size - prev->used > 0` with `prev->used < prev->size`. 2. This change ensures that the logic checks whether there is remaining space in the buffer without risking underflow. **References** [INT02-C. Understand integer conversion rules](https://wiki.sei.cmu.edu/confluence/display/c/INT02-C.+Understand+integer+conversion+rules) [CWE-191](https://cwe.mitre.org/data/definitions/191.html) |
Zeroday BYTE <github@zerodaysec.org> | no | 2025-05-26 | ||
| CVE-2025-32023.patch | Apply fixed for CVE-2025-32023 (#2314) | Ran Shidlansik <ranshid@amazon.com> | no | debian | upstream, https://github.com/valkey-io/valkey/commit/20f5199d96b | 2025-07-06 |
| CVE-2025-48367.patch | retry accept on transient errors (CVE-2025-48367) (#2315) | Ran Shidlansik <ranshid@amazon.com> | no | debian | upstream, https://github.com/valkey-io/valkey/commit/cb10d9d78f3594 | 2025-07-07 |
| CVE-2025-49844_CVE-2025-46817_CVE-2025-46818_CVE-2025-46819.patch | Fix format issues with CVE fix (#2681) | Madelyn Olson <madelyneolson@gmail.com> | no | 2025-10-03 | ||
| CVE-2025-67733.patch | Fix for [CVE-2025-67733] RESP Protocol Injection via Lua error_reply | Roshan Khatri <rvkhatri@amazon.com>, Madelyn Olson <madelyneolson@gmail.com> | no | debian | upstream, https://github.com/valkey-io/valkey/commit/3d7598e8c7db4857a0e76582861dec14b555c343.diff | 2026-02-23 |
| CVE-2026-21863.patch | Fix for [CVE-2026-21863] Remote DoS with malformed Valkey Cluster bus message | Roshan Khatri <rvkhatri@amazon.com>, Madelyn Olson <madelyneolson@gmail.com> | no | debian | backport, https://github.com/valkey-io/valkey/commit/416939303d2550aefff73ac180f41b84c12ba6c0.diff | 2026-02-23 |
| CVE-2026-56684.patch | Fix use-after-free in tlsProcessPendingData() on CLIENT KILL. | Madelyn Olson <madelyneolson@gmail.com> | yes | debian upstream | upstream, https://github.com/valkey-io/valkey/commit/33b14adf2026cfd8728607b026edb24843805844 | 2026-07-21 |
| CVE-2026-63639.patch | Reject corrupt stream RDB with shared NACK across consumers. | Saurabh K <saurabh@amazon.com> | yes | debian upstream | backport, https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291 | 2026-06-30 |
| CVE-2026-82631.patch | Fix case where client could get unblocked while processing another client. | Quanye Yang <quanyemostima@gmail.com> | yes | debian upstream | upstream, https://github.com/valkey-io/valkey/commit/f17a71df6ccd9a2476fd7534deb135593a8242bb | 2026-08-08 |
| CVE-2026-82677.patch | Prevent double-free of the module timer when the callback stops it. | Quanye Yang <quanyemostima@gmail.com> | yes | debian upstream | upstream, https://github.com/valkey-io/valkey/commit/345a057196edbd94f2f0be87d26a1299fcd95e60 | 2026-08-03 |
| CVE-2026-23479.patch | Fix UAF in unblockClientOnKey when reprocessed command frees the client. | Ran Shidlansik <ranshid@amazon.com> | yes | upstream | upstream, https://github.com/valkey-io/valkey/commit/ba11c9e4580bb1b84ca9d0fae83dcfe26ba47344 | 2026-05-06 |
| CVE-2026-23631.patch | Delay full sync during yielding Lua scripts to prevent use-after-free. | Ran Shidlansik <ranshid@amazon.com> | yes | upstream | upstream, https://github.com/valkey-io/valkey/commit/8c26ce460b1adf39f51c1821b845acd2d4eb6433 | 2026-05-06 |
| CVE-2026-25243.patch | Fix invalid memory access in RESTORE with malformed zipmap. | Ran Shidlansik <ranshid@amazon.com> | yes | upstream | upstream, https://github.com/valkey-io/valkey/commit/7dba5b6977e515830c5fdaaf69cbd783a20e7827 | 2026-05-06 |
All known versions for source package 'valkey'
- 9.1.2-1 (forky, sid)
- 8.1.1+dfsg1-3+deb13u3 (trixie-security)
- 8.1.1+dfsg1-3+deb13u2 (trixie)
- 8.0.1+dfsg1-1~bpo12+1 (bookworm-backports)