CVE-2018-11218 Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
CriticalCVSS 9.8
EPSS 58.8%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/redis(Debian:12) | < 5:4.0.10-1 | 5:4.0.10-1 |
| debian/redis(Debian:13) | < 5:4.0.10-1 | 5:4.0.10-1 |
| debian/redis(Debian:14) | < 5:4.0.10-1 | 5:4.0.10-1 |
| redislabs redis | < 3.2.12 | 3.2.12 |
| redislabs redis | >= 4.0, < 4.0.10 | 4.0.10 |
| redislabs redis | = 5.0-rc1 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| oracle communications operations monitor | = 3.4 | No fix listed |
| oracle communications operations monitor | = 4.0 | No fix listed |
| redhat openstack | = 10 | No fix listed |
| redhat openstack | = 13 | No fix listed |
| alpine/redis(Alpine:v3.5) | >= 4.0, < 3.2.12-r0 | 3.2.12-r0 |
| alpine/redis(Alpine:v3.6) | >= 4.0, < 3.2.12-r0 | 3.2.12-r0 |
| alpine/redis(Alpine:v3.7) | >= 4.0, < 4.0.10-r0 | 4.0.10-r0 |
References
- Debian Security Tracker CVE-2018-11218 vendor-advisory
- bugs.debian.org issue-tracking
- antirez.com exploit third-party-advisory
- 104553 third-party-advisory vdb-entry
- RHSA-2019:0052 third-party-advisory vendor-advisory
- RHSA-2019:0094 third-party-advisory vendor-advisory
- RHSA-2019:1860 vendor-advisory
- github.com exploit patch third-party-advisory
- github.com patch third-party-advisory
- github.com third-party-advisory
- raw.githubusercontent.com third-party-advisory
- raw.githubusercontent.com third-party-advisory
- GLSA-201908-04 vendor-advisory
- DSA-4230 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- security.alpinelinux.org vendor-advisory