Detections
Analytics

Fedora 41 : valkey (2025-00e79c49ca)

critical Nessus Plugin ID 270124

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-00e79c49ca advisory.

 **Valkey 8.0.6** - Released Fri 03 October 2025


 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

 Security fixes

 * **CVE-2025-49844** A Lua script may lead to remote code execution
 * **CVE-2025-46817** A Lua script may lead to integer overflow and potential RCE
 * **CVE-2025-46818** A Lua script can be executed in the context of another user
 * **CVE-2025-46819** LUA out-of-bound read

 Bug fixes

 * Fix accounting for dual channel RDB bytes in replication stats (#2616)
 * Minor fix for dual rdb channel connection conn error log (#2658)
 * Fix unsigned difference expression compared to zero (#2101)

 ----

 **Valkey 8.0.5** - Released Thu 22 Aug 2025

 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

 Bug fixes

 * Fix clients remaining blocked when reprocessing commands after certain blocking operations (#2109)
 * Fix a memory corruption issue in the sharded pub/sub unsubscribe logic (#2137)
 * Fix potential memory leak by ensuring module context is freed when `aux_save2` callback writes no data (#2132)
 * Fix `CLIENT UNBLOCK` triggering unexpected errors when used on paused clients (#2117)
 * Fix missing NULL check on `SSL_new()` when creating outgoing TLS connections (#2140)
 * Fix incorrect casting of ping extension lengths to prevent silent packet drops (#2144)
 * Fix replica failover stall due to outdated config epoch (#2178)
 * Fix incorrect port/tls-port info in `CLUSTER SLOTS`/`CLUSTER NODES` after dynamic config change (#2186)
 * Ensure empty error tables in Lua scripts don't crash Valkey (#2229)
 * Fix client tracking memory overhead calculation (#2360)
 * Handle divergent shard-id from nodes.conf and reconcile to the primary node's shard-id (#2174)
 * Fix pre-size hashtables per slot when reading RDB files (#2466)

 Behavior changes

 * Trigger election immediately during a forced manual failover (`CLUSTER FAILOVER FORCE`) to avoid delay (#1067)
 * Reset ongoing election state when initiating a new manual failover (#1274)

 Logging and Tooling Improvements

 * Add support to drop all cluster packets (#1252)
 * Improve log clarity in failover auth denial message (#1341)

 Security fixes

 * **CVE-2025-27151**: Check length of AOF file name in valkey-check-aof and reject paths longer than `PATH_MAX` (#2146)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected valkey package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2025-00e79c49ca

Plugin Details

Severity: Critical

ID: 270124

File Name: fedora_2025-00e79c49ca.nasl

Version: 1.1

Type: local

Agent: unix

Published: 10/13/2025

Updated: 10/13/2025

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 10.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-46817

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2025-49844

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:valkey, cpe:/o:fedoraproject:fedora:41

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/4/2025

Vulnerability Publication Date: 5/29/2025

Reference Information

CVE: CVE-2025-27151, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819, CVE-2025-49844