CVE-2018-8073: Code Injection
Potential remote code execution in LUA context of the redis server via methods yii\redis\ActiveRecord::findOne() and ::findAll()
Other sources
Potential remote code execution in LUA context of the redis server via methods yii\redis\ActiveRecord::findOne() and yii\redis\ActiveRecord::findAll() in yiisoft/yii2-redis. Attackers could probably manipulate data on the redis server.
— GitHub
Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/yiisoft/yii2-redisto a version that resolves this vulnerability.Fixed in 2.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2018-8073?
CVE-2018-8073 has been assigned a severity rating that indicates a risk of potential remote code execution.
How do I fix CVE-2018-8073?
To fix CVE-2018-8073, upgrade the yii2-redis package to version 2.0.9 or later.
Which versions of Yii are affected by CVE-2018-8073?
CVE-2018-8073 affects Yii framework versions prior to 2.0.15.
What specific methods in Yii are vulnerable under CVE-2018-8073?
The vulnerable methods are `yii\redis\ActiveRecord::findOne()` and `::findAll()`.
Is remote code execution possible with CVE-2018-8073?
Yes, CVE-2018-8073 allows for potential remote code execution in the LUA context of the Redis server.