Vulnerabilities > CVE-2018-12453 - Incorrect Type Conversion or Cast vulnerability in Redislabs Redis

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

redislabs

CWE-704

exploit available

NVD

Published: 2018-06-16

Updated: 2018-08-14

Summary

Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.

Vulnerable Configurations

Part	Description	Count
Application	Redislabs Redislabs Redis 1.3.6 Redislabs Redis 1.3.7 Redislabs Redis 1.3.8 Redislabs Redis 1.3.9 Redislabs Redis 1.3.10 Redislabs Redis 1.3.11 Redislabs Redis 1.3.12 Redislabs Redis 2.0.0 Redislabs Redis 2.0.1 Redislabs Redis 2.0.2 Redislabs Redis 2.0.3 Redislabs Redis 2.0.4 Redislabs Redis 2.0.5 Redislabs Redis 2.1.1 Redislabs Redis 2.2 Redislabs Redis 2.2.0 Redislabs Redis 2.2.1 Redislabs Redis 2.2.2 Redislabs Redis 2.2.3 Redislabs Redis 2.2.4 Redislabs Redis 2.2.5 Redislabs Redis 2.2.6 Redislabs Redis 2.2.7 Redislabs Redis 2.2.8 Redislabs Redis 2.2.9 Redislabs Redis 2.2.10 Redislabs Redis 2.2.11 Redislabs Redis 2.2.12 Redislabs Redis 2.2.13 Redislabs Redis 2.2.14 Redislabs Redis 2.2.15 Redislabs Redis 2.2.105 Redislabs Redis 2.2.106 Redislabs Redis 2.2.107 Redislabs Redis 2.2.110 Redislabs Redis 2.2.111 Redislabs Redis 2.3 Redislabs Redis 2.4.0 Redislabs Redis 2.4.1 Redislabs Redis 2.4.2 Redislabs Redis 2.4.3 Redislabs Redis 2.4.4 Redislabs Redis 2.4.5 Redislabs Redis 2.4.6 Redislabs Redis 2.4.7 Redislabs Redis 2.4.8 Redislabs Redis 2.4.9 Redislabs Redis 2.4.10 Redislabs Redis 2.4.11 Redislabs Redis 2.4.12 Redislabs Redis 2.4.13 Redislabs Redis 2.4.14 Redislabs Redis 2.4.15 Redislabs Redis 2.4.16 Redislabs Redis 2.4.17 Redislabs Redis 2.4.18 Redislabs Redis 2.6.0 Redislabs Redis 2.6.1 Redislabs Redis 2.6.2 Redislabs Redis 2.6.3 Redislabs Redis 2.6.4 Redislabs Redis 2.6.5 Redislabs Redis 2.6.6 Redislabs Redis 2.6.7 Redislabs Redis 2.6.7-1 Redislabs Redis 2.6.8 Redislabs Redis 2.6.8-1 Redislabs Redis 2.6.9 Redislabs Redis 2.6.9-1 Redislabs Redis 2.6.10 Redislabs Redis 2.6.10-1 Redislabs Redis 2.6.10-2 Redislabs Redis 2.6.10-3 Redislabs Redis 2.6.11 Redislabs Redis 2.6.12 Redislabs Redis 2.6.13 Redislabs Redis 2.6.14 Redislabs Redis 2.6.14-1 Redislabs Redis 2.6.14-2 Redislabs Redis 2.6.15 Redislabs Redis 2.6.16 Redislabs Redis 2.6.17 Redislabs Redis 2.8.0 Redislabs Redis 2.8.1 Redislabs Redis 2.8.2 Redislabs Redis 2.8.3 Redislabs Redis 2.8.4 Redislabs Redis 2.8.5 Redislabs Redis 2.8.6 Redislabs Redis 2.8.7 Redislabs Redis 2.8.8 Redislabs Redis 2.8.9 Redislabs Redis 2.8.10 Redislabs Redis 2.8.11 Redislabs Redis 2.8.12 Redislabs Redis 2.8.13 Redislabs Redis 2.8.14 Redislabs Redis 2.8.15 Redislabs Redis 2.8.16 Redislabs Redis 2.8.17 Redislabs Redis 2.8.18 Redislabs Redis 2.8.19 Redislabs Redis 2.8.20 Redislabs Redis 2.8.21 Redislabs Redis 2.8.22 Redislabs Redis 2.8.23 Redislabs Redis 2.8.24 Redislabs Redis 3.0 Redislabs Redis 3.0.0 Redislabs Redis 3.0.1 Redislabs Redis 3.0.2 Redislabs Redis 3.0.3 Redislabs Redis 3.0.4 Redislabs Redis 3.0.5 Redislabs Redis 3.0.6 Redislabs Redis 3.0.7 Redislabs Redis 3.2 Redislabs Redis 3.2.0 Redislabs Redis 3.2.1 Redislabs Redis 3.2.2 Redislabs Redis 3.2.3 Redislabs Redis 3.2.4 Redislabs Redis 3.2.5 Redislabs Redis 3.2.6 Redislabs Redis 3.2.7 Redislabs Redis 3.2.8 Redislabs Redis 3.2.9 Redislabs Redis 3.2.10 Redislabs Redis 3.2.11 Redislabs Redis 3.2.12 Redislabs Redis 3.2.13 Redislabs Redis 4.0 Redislabs Redis 4.0.0 Redislabs Redis 4.0.1 Redislabs Redis 4.0.2 Redislabs Redis 4.0.3 Redislabs Redis 4.0.4 Redislabs Redis 4.0.5 Redislabs Redis 4.0.6 Redislabs Redis 4.0.7 Redislabs Redis 4.0.8 Redislabs Redis 4.0.9 Redislabs Redis 4.0.10 Redislabs Redis 4.0.11 Redislabs Redis 4.0.12 Redislabs Redis 4.0.13 Redislabs Redis 4.0.14	208

Common Weakness Enumeration (CWE)

CWE-704 - Incorrect Type Conversion or Cast

Exploit-Db

description	Redis 5.0 - Denial of Service. CVE-2018-12453. Dos exploit for Linux platform
file	exploits/linux/dos/44908.txt
id	EDB-ID:44908
last seen	2018-06-20
modified	2018-06-20
platform	linux
port
published	2018-06-20
reporter	Exploit-DB
source	https://www.exploit-db.com/download/44908/
title	Redis 5.0 - Denial of Service
type	dos

Packetstorm

data source	https://packetstormsecurity.com/files/download/148270/redis50-dos.txt
id	PACKETSTORM:148270
last seen	2018-06-23
published	2018-06-21
reporter	Fakhri Zulkifli
source	https://packetstormsecurity.com/files/148270/Redis-5.0-Denial-Of-Service.html
title	Redis 5.0 Denial Of Service

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Exploit-Db

Packetstorm

References