Trusty version (2:2.8.4-2) has not been bumped to address security vulnerabilities

[aren55555]

The Trusty Redis package version is still 2.8.4. There seem to have been a number of incremental 2.8.x redis versions that have been released since 2.8.4 in Jan 2014. The most recent 2.8.x release being 2.8.24 released in Dec 2015.

A number of the versions > 2.8.4 address "Critical" security issues; 2.8.21 introduced a fix to the "Redis EVAL Lua Sandbox Escape" detailed here http://t.co/LpGTyZmfS7

I am wondering if the Trusty packages will be updated? If shown how I could likely take a stab at this myself.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Seth Arnold (seth-arnold)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Seth Arnold (seth-arnold)]

The quickest way to get Redis updated is to find the patches that fix vulnerabilities and add them to the package. Once the package has been tested, the security team would be happy to sponsor an update. Some information on this process can be found at https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

The list of issues that we know about for Redis can be found at http://people.canonical.com/~ubuntu-security/cve/pkg/redis.html

Thanks

[Andrei Coada (raziel.kernel)]

The most convenient fix is to update the package to upstream v2.8.24.

I've subscribed the MOTU Team. Please help us ! :)

[Launchpad Janitor (janitor)]

[Expired for redis (Ubuntu) because there has been no activity for 60 days.]