CVE-2018-11218: Buffer Overflow
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
Other sources
Redis is vulnerable to heap corruption in luacmsgpack.c. An attacker could exploit this to cause a denial of service or have other potential unspecified impact.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/redisto a version that resolves this vulnerability.Fixed in 5:5.0.14-1+deb10u2Fixed in 5:5.0.14-1+deb10u4Fixed in 5:6.0.16-1+deb11u2Fixed in 5:7.0.11-1Fixed in 5:7.0.13-2Fixed in 5:7.0.14-1 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 3.2.12 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 4.0.10 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 5.0
Event History
Frequently Asked Questions
What is the vulnerability ID of this memory corruption vulnerability?
The vulnerability ID is CVE-2018-11218.
What is the severity of CVE-2018-11218?
The severity of CVE-2018-11218 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2018-11218?
CVE-2018-11218 affects Redis versions before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2.
How can I fix CVE-2018-11218 on Debian systems?
To fix CVE-2018-11218 on Debian systems, upgrade the Redis package to version 5:5.0.14-1+deb10u2 or newer.
How can I fix CVE-2018-11218 on Red Hat systems?
To fix CVE-2018-11218 on Red Hat systems, upgrade the Redis package to version 3.2.12, 4.0.10, or 5.0 or newer.