PT-2018-2777 · Redis+2 · Redis+2

Published 2018-06-13 · Updated 2024-06-15 · CVE-2018-11218

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redis versions prior to 3.2.12 Redis versions 4.x prior to 4.0.10 Redis versions 5.x prior to 5.0 RC2

Description A Memory Corruption issue was discovered in the cmsgpack library of the Lua subsystem due to stack-based buffer overflows. This issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Redis versions prior to 3.2.12, update to version 3.2.12 or later. For Redis versions 4.x prior to 4.0.10, update to version 4.0.10 or later. For Redis versions 5.x prior to 5.0 RC2, update to version 5.0 RC2 or later.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

ALT-PU-2018-1906

BDU:2019-01775

CVE-2018-11218

DLA-1396-1

DSA-4230-1

MGASA-2018-0309

OPENSUSE-SU-2018_1802-1

OPENSUSE-SU-2024:11299-1

RHSA-2019:0052

RHSA-2019:0094

RHSA-2019:1860

SUSE-OU-2020:3291-1

Affected Products

Alt Linux

Redis

Suse

References · 52

• 🔥 https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3 · Exploit
• 🔥 http://antirez.com/news/119 · Exploit
• https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-11218 · Security Note
• https://access.redhat.com/errata/RHSA-2019:0052 · Vendor Advisory
• https://debian.org/security/2018/dsa-4230 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0309.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11299-1 · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2018-11218 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0094 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-11218 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11218 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20230412SE16MD · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-OU-2020:3291-1 · Vendor Advisory