Vulnerabilities > CVE-2018-11218 - Out-of-bounds Write vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

critical

nessus

NVD

Published: 2018-06-17

Updated: 2024-11-21

Summary

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.

Vulnerable Configurations

Part	Description	Count
Application	Redislabs Redislabs Redis 5.0 Redislabs Redis 1.3.6 Redislabs Redis 1.3.7 Redislabs Redis 1.3.8 Redislabs Redis 1.3.9 Redislabs Redis 1.3.10 Redislabs Redis 1.3.11 Redislabs Redis 1.3.12 Redislabs Redis 2.0.0 Redislabs Redis 2.0.1 Redislabs Redis 2.0.2 Redislabs Redis 2.0.3 Redislabs Redis 2.0.4 Redislabs Redis 2.0.5 Redislabs Redis 2.1.1 Redislabs Redis 2.2 Redislabs Redis 2.2.0 Redislabs Redis 2.2.1 Redislabs Redis 2.2.2 Redislabs Redis 2.2.3 Redislabs Redis 2.2.4 Redislabs Redis 2.2.5 Redislabs Redis 2.2.6 Redislabs Redis 2.2.7 Redislabs Redis 2.2.8 Redislabs Redis 2.2.9 Redislabs Redis 2.2.10 Redislabs Redis 2.2.11 Redislabs Redis 2.2.12 Redislabs Redis 2.2.13 Redislabs Redis 2.2.14 Redislabs Redis 2.2.15 Redislabs Redis 2.2.105 Redislabs Redis 2.2.106 Redislabs Redis 2.2.107 Redislabs Redis 2.2.110 Redislabs Redis 2.2.111 Redislabs Redis 2.3 Redislabs Redis 2.4.0 Redislabs Redis 2.4.1 Redislabs Redis 2.4.2 Redislabs Redis 2.4.3 Redislabs Redis 2.4.4 Redislabs Redis 2.4.5 Redislabs Redis 2.4.6 Redislabs Redis 2.4.7 Redislabs Redis 2.4.8 Redislabs Redis 2.4.9 Redislabs Redis 2.4.10 Redislabs Redis 2.4.11 Redislabs Redis 2.4.12 Redislabs Redis 2.4.13 Redislabs Redis 2.4.14 Redislabs Redis 2.4.15 Redislabs Redis 2.4.16 Redislabs Redis 2.4.17 Redislabs Redis 2.4.18 Redislabs Redis 2.6.0 Redislabs Redis 2.6.1 Redislabs Redis 2.6.2 Redislabs Redis 2.6.3 Redislabs Redis 2.6.4 Redislabs Redis 2.6.5 Redislabs Redis 2.6.6 Redislabs Redis 2.6.7 Redislabs Redis 2.6.7-1 Redislabs Redis 2.6.8 Redislabs Redis 2.6.8-1 Redislabs Redis 2.6.9 Redislabs Redis 2.6.9-1 Redislabs Redis 2.6.10 Redislabs Redis 2.6.10-1 Redislabs Redis 2.6.10-2 Redislabs Redis 2.6.10-3 Redislabs Redis 2.6.11 Redislabs Redis 2.6.12 Redislabs Redis 2.6.13 Redislabs Redis 2.6.14 Redislabs Redis 2.6.14-1 Redislabs Redis 2.6.14-2 Redislabs Redis 2.6.15 Redislabs Redis 2.6.16 Redislabs Redis 2.6.17 Redislabs Redis 2.8.0 Redislabs Redis 2.8.1 Redislabs Redis 2.8.2 Redislabs Redis 2.8.3 Redislabs Redis 2.8.4 Redislabs Redis 2.8.5 Redislabs Redis 2.8.6 Redislabs Redis 2.8.7 Redislabs Redis 2.8.8 Redislabs Redis 2.8.9 Redislabs Redis 2.8.10 Redislabs Redis 2.8.11 Redislabs Redis 2.8.12 Redislabs Redis 2.8.13 Redislabs Redis 2.8.14 Redislabs Redis 2.8.15 Redislabs Redis 2.8.16 Redislabs Redis 2.8.17 Redislabs Redis 2.8.18 Redislabs Redis 2.8.19 Redislabs Redis 2.8.20 Redislabs Redis 2.8.21 Redislabs Redis 2.8.22 Redislabs Redis 2.8.23 Redislabs Redis 2.8.24 Redislabs Redis 3.0 Redislabs Redis 3.0.0 Redislabs Redis 3.0.1 Redislabs Redis 3.0.2 Redislabs Redis 3.0.3 Redislabs Redis 3.0.4 Redislabs Redis 3.0.5 Redislabs Redis 3.0.6 Redislabs Redis 3.0.7 Redislabs Redis 3.2 Redislabs Redis 3.2.0 Redislabs Redis 3.2.1 Redislabs Redis 3.2.2 Redislabs Redis 3.2.3 Redislabs Redis 3.2.4 Redislabs Redis 3.2.5 Redislabs Redis 3.2.6 Redislabs Redis 3.2.7 Redislabs Redis 3.2.8 Redislabs Redis 3.2.9 Redislabs Redis 3.2.10 Redislabs Redis 3.2.11 Redislabs Redis 4.0 Redislabs Redis 4.0.0 Redislabs Redis 4.0.1 Redislabs Redis 4.0.2 Redislabs Redis 4.0.3 Redislabs Redis 4.0.4 Redislabs Redis 4.0.5 Redislabs Redis 4.0.6 Redislabs Redis 4.0.7 Redislabs Redis 4.0.8 Redislabs Redis 4.0.9	202
Application	Oracle Oracle Communications Operations Monitor 3.4 Oracle Communications Operations Monitor 4.0	2
Application	Redhat Redhat Openstack 10 Redhat Openstack 13	2
OS	Debian Debian Debian Linux 9.0	1

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-4230.NASL
description	Multiple vulnerabilities were discovered in the Lua subsystem of Redis, a persistent key-value database, which could result in denial of service.
last seen	2020-06-01
modified	2020-06-02
plugin id	110571
published	2018-06-18
reporter	This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110571
title	Debian DSA-4230-1 : redis - security update

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-667.NASL
description	This update for redis to 4.0.10 fixes the following issues : These security issues were fixed : - CVE-2018-11218: Prevent heap corruption vulnerability in cmsgpack (bsc#1097430). - CVE-2018-11219: Prevent integer overflow in Lua scripting (bsc#1097768). For Leap 42.3 and openSUSE SLE 12 backports this is a jump from 4.0.6. For additional details please see - https://raw.githubusercontent.com/antirez/redis/4.0.9/00-RELEASENOTES - https://raw.githubusercontent.com/antirez/redis/4.0.8/00-RELEASENOTES - https://raw.githubusercontent.com/antirez/redis/4.0.7/00-RELEASENOTES
last seen	2020-06-05
modified	2018-06-25
plugin id	110678
published	2018-06-25
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110678
title	openSUSE Security Update : redis (openSUSE-2018-667)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201908-04.NASL
description	The remote host is affected by the vulnerability described in GLSA-201908-04 (Redis: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Redis. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	127562
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127562
title	GLSA-201908-04 : Redis: Multiple vulnerabilities

NASL family	Misc.
NASL id	REDIS_4_0_10.NASL
description	The version of Redis installed on the remote host is affected by multiple vulnerabilities and therefore requires a security update.
last seen	2020-06-01
modified	2020-06-02
plugin id	117484
published	2018-09-14
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/117484
title	Pivotal Software Redis LUA < 3.2.12 / 4.0.x < 4.0.10 / 5.0 < 5.0rc2 Multiple Vulnerabilities

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2018-1_0-0156.NASL
description	An update of 'redis' packages of Photon OS has been released.
last seen	2019-02-08
modified	2019-02-07
plugin id	111940
published	2018-08-17
reporter	Tenable
source	https://www.tenable.com/plugins/index.php?view=single&id=111940
title	Photon OS 1.0: Redis PHSA-2018-1.0-0156 (deprecated)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2018-1_0-0156_REDIS.NASL
description	An update of the redis package has been released.
last seen	2020-03-17
modified	2019-02-07
plugin id	121854
published	2019-02-07
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121854
title	Photon OS 1.0: Redis PHSA-2018-1.0-0156

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-481.NASL
description	This update for redis to 4.0.10 fixes the following issues : These security issues were fixed : - CVE-2018-11218: Prevent heap corruption vulnerability in cmsgpack (bsc#1097430). - CVE-2018-11219: Prevent integer overflow in Lua scripting (bsc#1097768). For Leap 42.3 and openSUSE SLE 12 backports this is a jump from 4.0.6. For additional details please see - https://raw.githubusercontent.com/antirez/redis/4.0.9/00-RELEASENOTES - https://raw.githubusercontent.com/antirez/redis/4.0.8/00-RELEASENOTES - https://raw.githubusercontent.com/antirez/redis/4.0.7/00-RELEASENOTES
last seen	2020-05-31
modified	2019-03-27
plugin id	123199
published	2019-03-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123199
title	openSUSE Security Update : redis (openSUSE-2019-481)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2018-2_0-0070.NASL
description	An update of 'redis', 'vim' packages of Photon OS has been released.
last seen	2019-02-08
modified	2019-02-07
plugin id	111955
published	2018-08-17
reporter	Tenable
source	https://www.tenable.com/plugins/index.php?view=single&id=111955
title	Photon OS 2.0: Redis / Vim PHSA-2018-2.0-0070 (deprecated)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2018-2_0-0070_REDIS.NASL
description	An update of the redis package has been released.
last seen	2020-03-17
modified	2019-02-07
plugin id	121964
published	2019-02-07
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121964
title	Photon OS 2.0: Redis PHSA-2018-2.0-0070

Redhat

advisories

rhsa
id RHSA-2019:0052
rhsa
id RHSA-2019:0094
rhsa
id RHSA-2019:1860

rpms

redis-0:3.0.6-4.el7ost
redis-debuginfo-0:3.0.6-4.el7ost
redis-0:3.2.8-3.el7ost
redis-debuginfo-0:3.2.8-3.el7ost
rh-redis32-redis-0:3.2.13-1.el6
rh-redis32-redis-0:3.2.13-1.el7
rh-redis32-redis-debuginfo-0:3.2.13-1.el6
rh-redis32-redis-debuginfo-0:3.2.13-1.el7

References

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.