CVE-2018-11219
published 2018-06-17CVE-2018-11219: An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading…
PriorityP347critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
6.72%
93.9th percentile
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | redis | < redis 5:4.0.10-1 (bookworm) | redis 5:4.0.10-1 (bookworm) |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_operations_monitor | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redis | redis | >= 0 < 5:4.0.10-1 | 5:4.0.10-1 |
| redis | redis | >= 0 < 5:4.0.10-1 | 5:4.0.10-1 |
| redis | redis | >= 0 < 5:4.0.10-1 | 5:4.0.10-1 |
| redis | redis | >= 0 < 5:4.0.10-1 | 5:4.0.10-1 |
| redislabs | redis | < 3.2.12 | 3.2.12 |
| redislabs | redis | — | — |
| redislabs | redis | >= 4.0 < 4.0.10 | 4.0.10 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pqpx-gpvg-4m34: An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3
ghsa_unreviewed·2022-05-13
CVE-2018-11219 [CRITICAL] CWE-190 GHSA-pqpx-gpvg-4m34: An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
OSV
CVE-2018-11219: An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3
osv·2018-06-17·CVSS 9.8
CVE-2018-11219 [CRITICAL] CVE-2018-11219: An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
Red Hat
redis: Integer overflow in lua_struct.c:b_unpack()
vendor_redhat·2018-06-13·CVSS 9.8
CVE-2018-11219 [CRITICAL] CWE-190 redis: Integer overflow in lua_struct.c:b_unpack()
redis: Integer overflow in lua_struct.c:b_unpack()
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
Package: redis (Red Hat Enterprise Linux 8) - Not affected
Package: redis (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)) - Will not fix
Package: redis (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools) - Will not fix
Package: camel-spring-redis (Red Hat Fuse 7) - Not affected
Package: camel-spring-redis (Red Hat JBoss Fuse 6) - Not affected
Package: rhmap-redis-docker (Red Hat Mobile Application Platform 4) - Will not fix
Package: redis (Red Hat OpenStack Platform 12 (Pike)) - Will not fix
Package: redis (Red Hat
Debian
CVE-2018-11219: redis - An Integer Overflow issue was discovered in the struct library in the Lua subsys...
vendor_debian·2018·CVSS 9.8
CVE-2018-11219 [CRITICAL] CVE-2018-11219: redis - An Integer Overflow issue was discovered in the struct library in the Lua subsys...
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
Scope: local
bookworm: resolved (fixed in 5:4.0.10-1)
bullseye: resolved (fixed in 5:4.0.10-1)
forky: resolved (fixed in 5:4.0.10-1)
sid: resolved (fixed in 5:4.0.10-1)
trixie: resolved (fixed in 5:4.0.10-1)
No detection rules found.
No public exploits indexed.
Tenable
Oracle Critical Patch Update For April Contains 297 Fixes
blogs_tenable·2019-04-17
Oracle Critical Patch Update For April Contains 297 Fixes
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack() [epel-all]
bugzilla·2018-06-15·CVSS 9.8
CVE-2018-11219 [CRITICAL] CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack() [epel-all]
CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack() [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack() [fedora-all]
bugzilla·2018-06-15·CVSS 9.8
CVE-2018-11219 [CRITICAL] CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack() [fedora-all]
CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack() [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported version
Bugzilla
CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack()
bugzilla·2018-06-12·CVSS 9.8
CVE-2018-11219 [CRITICAL] CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack()
CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack()
Redis is vulnerable to an integer overflow in the lua_struct.c:b_unpack() function. A remote attacker could exploit this to cause a denial of service or have other unspecified impact.
Discussion:
External References:
http://antirez.com/news/119
---
Created redis tracking bugs for this issue:
Affects: epel-all [bug 1591538]
Affects: fedora-all [bug 1591540]
---
We already have 4.0.10
---
Patches:
https://github.com/antirez/redis/commit/1eb08bcd4634ae42ec45e8284923ac048beaa4c3
https://github.com/antirez/redis/commit/e89086e09a38cc6713bcd4b9c29abf92cf393936
---
This issue has been addressed in the following products:
Red Hat OpenStack Platform 10.0 (Newton)
Via RHSA-2019:0052 https://access.redhat.com/errata/RHSA
http://antirez.com/news/119http://www.securityfocus.com/bid/104552https://access.redhat.com/errata/RHSA-2019:0052https://access.redhat.com/errata/RHSA-2019:0094https://access.redhat.com/errata/RHSA-2019:1860https://github.com/antirez/redis/commit/1eb08bcd4634ae42ec45e8284923ac048beaa4c3https://github.com/antirez/redis/commit/e89086e09a38cc6713bcd4b9c29abf92cf393936https://github.com/antirez/redis/issues/5017https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTEShttps://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTEShttps://security.gentoo.org/glsa/201908-04https://www.debian.org/security/2018/dsa-4230https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttp://antirez.com/news/119http://www.securityfocus.com/bid/104552https://access.redhat.com/errata/RHSA-2019:0052https://access.redhat.com/errata/RHSA-2019:0094https://access.redhat.com/errata/RHSA-2019:1860https://github.com/antirez/redis/commit/1eb08bcd4634ae42ec45e8284923ac048beaa4c3https://github.com/antirez/redis/commit/e89086e09a38cc6713bcd4b9c29abf92cf393936https://github.com/antirez/redis/issues/5017https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTEShttps://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTEShttps://security.gentoo.org/glsa/201908-04https://www.debian.org/security/2018/dsa-4230https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
2018-06-17
Published