Redis 7.0.12 released with security and bug fixes

guide

Redis 7.0.12 released with security fixes and bug fixes.

Upgrade Urgency Security: See Security Fixes below.

security fixes

1. (CVE-2022-24834) Executing a specially crafted Lua script in Redis could trigger a heap overflow in the cjson and cmsgpack libraries.
2. Heap overflow, leading to heap corruption and possible remote code execution.
3. Causes heap corruption and may lead to remote code execution. The problem exists in all versions of Redis. Only authenticated and authorized users are affected.
4. (CVE-2023-36824) Extract key names from command and argument lists
5. (CVE-2023-36824) Extracting key names from command and argument lists could trigger a heap overflow under certain circumstances, resulting in random heap memory reads, heap corruption, and possible remote code execution. In particular, use COMMAND GETKEYS* and key name validation in ACL rules.

bug fixes

1. Re-enable downgrade rewash when forking child processes (#12276)
2. Fixed possible hang in HRANDFIELD, SRANDMEMBER, ZRANDMEMBER when used with
3. Improve fairness issues in RANDOMKEY, HRANDFIELD, SRANDMEMBER, ZRANDMEMBER, SPOP and eviction (#12276)
4. Fix WAIT taking effect after blocked module commands are unblocked (#12220)
5. Avoid unnecessary full sync after master restart in rare cases (#12088)