Stack-based buffer overflow in Redis - CVE-2018-11218

Vulnerability identifier: #VU13380

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-11218

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to stack-based buffer overflow in the cmsgpack library in the Lua subsystem. A remote unauthenticated attacker can trigger memory corruption and cause the service to crash.

Redis
Debian Linux
Gentoo Linux
SUSE Linux
redis (Alpine package)
openSUSE Leap
rh-redis32-redis (Red Hat package)
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Red Hat OpenStack Director Deployment Tools

Update to version 3.2.12, 4.0.10, 5.0 RC2.

redis (Alpine package) - update to 3.2.12-r0
rh-redis32-redis (Red Hat package) - addressed in versions 3.2.13-1.el6, 3.2.13-1.el7

• https://github.com/antirez/redis/issues/5017

• Debian update for redis
• OpenSUSE Linux update for redis
• SUSE Linux update for redis
• Red Hat update for redis
• Red Hat update for redis
• Gentoo update for Redis
• Stack-based buffer overflow in redis (Alpine package)
• Red Hat Software Collections update for rh-redis32-redis