redis-stack/redis-stack v6.2.6-v10

Redis Stack Server 6.2.6-v10

on GitHub

This is a maintenance release for Redis Stack Server 6.2.6

Update urgency: SECURITY: there are security fixes in the release.

Headlines:

This version contains a security fix for the Redis server to avoid bypassing desired Unix socket permissions on startup. It also includes the latest Search and Query capability with a fix to limit the maximum phonetic length and several bug fixes. This version contains the latest version of RedisInsight.

Details:

Security and privacy:

• Redis:

  • (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.

• Search and Query:

  • #3844 Limits maximum phonetic length avoiding to be exploited (MOD 5767)

Bug Fixes

• Search and Query:
  • #3771 Broken lower and upper APPLY functions in FT.AGGREGATE on DIALECT 3 (MOD-5041)
  • #3910 Heavy document updates causing memory growth once memory blocks weren't properly released (MOD-5181)
  • #3853 Queries with WITHCURSOR making memory growth since CURSOR wasn't invalidated in the shards (MOD-5580)
  • #3752 Setting low MAXIDLE parameter value in FT.AGGREGATE causes a crash (MOD-5608)
  • #3823 APPLY or FILTER expression causing a leak (MOD-5751)
  • #3837 Connection using TLS fails on Redis (MOD-5768)
  • #3856 Adding new nodes to OSS cluster causing a crash (MOD-5778)
  • #3854 Vector range query could cause Out-of-Memory due a memory corruption (MOD-5791)
  • #3892 After cleaning the index the GC could cause corruption on unique values (MOD-5815)

Redis version

• Redis 6.2.14

Module versions

• RediSearch 2.6.14
• RedisJSON 2.4.7
• RedisGraph 2.10.12
• RedisTimeSeries 1.8.11
• RedisBloom 2.4.5

Recommended Client Libraries

• Java
  • Jedis 5.0.2 or greater
  • redis-om-spring 0.8.7 or greater
• Python
  • redis-py 5.0.1 or greater
  • redis-om-python 0.2.1 or greater
• NodeJS
  • node-redis 4.6.10 or greater
  • redis-om-node 0.2.0 or greater
• .NET
  • redis-om-dotnet 0.5.4 or greater
  • NRedisStack 0.10.1 or greater
• Go
  • go-redis 9.3.0 or greater
  • rueidis 1.0.22 or greater

Compatible with RedisInsight. The docker image redis/redis-stack for this version is bundled with RedisInsight 2.36.

Note: version numbers follow the following pattern:
x.y.z-b

• x.y Redis Major version
• z increases with even numbers as a module x.y version increases.
• b denotes a patch to Redis or a module (any z of Redis or Modules). b will consist of a v + numeric value.