Upgrade valkey to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 (microsoft#14835)

Signed-off-by: Kanishk Bansal <[email protected]>
Co-authored-by: Kanishk Bansal <[email protected]>

Author: Kanishk-Bansal

SPECS/valkey/CVE-2025-27151.patch

@@ -1,30 +1,30 @@
-From d9f795c8181d2db70626b7d43ebb2e6e8d2fbed8 Mon Sep 17 00:00:00 2001
-From: Rohit Rawat <xordux@gmail.com>
-Date: Tue, 29 Oct 2024 14:10:20 +0000
+From e10d46d1cb92c25d1f72735661496fe8527d499c Mon Sep 17 00:00:00 2001
+From: Kanishk Bansal <kanbansal@microsoft.com>
+Date: Wed, 8 Oct 2025 06:42:39 +0000
 Subject: [PATCH] Disable flaky mem defrag tests
 
 ---
  tests/unit/memefficiency.tcl | 2 ++
  1 file changed, 2 insertions(+)
 
 diff --git a/tests/unit/memefficiency.tcl b/tests/unit/memefficiency.tcl
-index d5a6a6e..37e1711 100644
+index 4dc04f6..7418980 100644
 --- a/tests/unit/memefficiency.tcl
 +++ b/tests/unit/memefficiency.tcl
-@@ -720,6 +720,7 @@ run_solo {defrag} {
+@@ -721,6 +721,7 @@ run_solo {defrag} {
      }
      }
 
 +    if {0} {
-     start_cluster 1 0 {tags {"defrag external:skip cluster"} overrides {appendonly yes auto-aof-rewrite-percentage 0 save ""}} {
+     start_cluster 1 0 {tags {"defrag external:skip cluster"} overrides {appendonly yes auto-aof-rewrite-percentage 0 save "" lazyfree-lazy-user-del no}} {
          test_active_defrag "cluster"
      }
-@@ -727,4 +728,5 @@ run_solo {defrag} {
-     start_server {tags {"defrag external:skip standalone"} overrides {appendonly yes auto-aof-rewrite-percentage 0 save ""}} {
+@@ -728,4 +729,5 @@ run_solo {defrag} {
+     start_server {tags {"defrag external:skip standalone"} overrides {appendonly yes auto-aof-rewrite-percentage 0 save "" lazyfree-lazy-user-del no}} {
          test_active_defrag "standalone"
      }
 +    }
  } ;# run_solo
 -- 
-2.39.4
+2.45.4
 

SPECS/valkey/CVE-2025-49112.patch

@@ -1,5 +1,5 @@
 {
  "Signatures": {
-  "valkey-8.0.4.tar.gz": "55c12a25f67ef19b615c76b6cb0c92d12753d76eb8d38b31d30e299c3490cdf2"
+  "valkey-8.0.6.tar.gz": "f8d15c257a3619e0e42e68998e9dc16536009d257662efa4c62ef7d08a71b0dd"
  }
 }

SPECS/valkey/disable-mem-defrag-tests.patch

@@ -1,17 +1,15 @@
 Summary:        advanced key-value store
 Name:           valkey
-Version:        8.0.4
+Version:        8.0.6
 Release:        1%{?dist}
 License:        BSD
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 Group:          Applications/Databases
 URL:            https://valkey.io/
 Source0:        https://github.com/valkey-io/valkey/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz
-Patch0:         valkey-conf.patch
-Patch1:         disable-mem-defrag-tests.patch
-Patch2:         CVE-2025-49112.patch
-Patch3:         CVE-2025-27151.patch
+Patch0:         disable-mem-defrag-tests.patch
+
 BuildRequires:  gcc
 BuildRequires:  make
 BuildRequires:  openssl-devel
@@ -86,6 +84,10 @@ exit 0
 %config(noreplace) %attr(0640, %{name}, %{name}) %{_sysconfdir}/valkey.conf
 
 %changelog
+* Wed Oct 08 2025 Kanishk Bansal <[email protected]> - 8.0.6-1
+- Upgrade to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819
+- Remove older patches of CVE-2025-27151  CVE-2025-49112
+
 * Tue Jul 22 2025 Kevin Lockwood <[email protected]> - 8.0.4-1
 - Upgrade to 8.0.4 to fix CVE-2025-32023, CVE-2025-48367
 

SPECS/valkey/valkey-conf.patch

@@ -29716,8 +29716,8 @@
         "type": "other",
         "other": {
           "name": "valkey",
-          "version": "8.0.4",
-          "downloadUrl": "https://github.com/valkey-io/valkey/archive/refs/tags/8.0.4.tar.gz"
+          "version": "8.0.6",
+          "downloadUrl": "https://github.com/valkey-io/valkey/archive/refs/tags/8.0.6.tar.gz"
         }
       }
     },