CVE-2018-11218
Fixed in a distro release EPSS 59%
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
Products: redislabs redis, debian_linux, oracle communications_operations_monitor, redhat openstack
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.5 | redis | 3.2.12-r0 |
| Alpine 3.6 | redis | 3.2.12-r0 |
| Alpine 3.7 | redis | 4.0.10-r0 |
| Debian 12 | redis | 5:4.0.10-1 |
| Debian 13 | redis | 5:4.0.10-1 |
| Debian 14 | redis | 5:4.0.10-1 |
| Debian 8 | redis | 2:2.8.17-1+deb8u6 |
| Debian 9 | redis | 3:3.2.6-3+deb9u1 |
| Red Hat openstack 10 | redis | 0:3.0.6-4.el7ost |
| Red Hat openstack 10 | redis-debuginfo | 0:3.0.6-4.el7ost |
| Red Hat openstack 13 | redis | 0:3.2.8-3.el7ost |
| Red Hat openstack 13 | redis-debuginfo | 0:3.2.8-3.el7ost |
| Red Hat rhel software collections 3 | rh-redis32-redis | 0:3.2.13-1.el6 |
| Red Hat rhel software collections 3 | rh-redis32-redis | 0:3.2.13-1.el7 |
| Red Hat rhel software collections 3 | rh-redis32-redis-debuginfo | 0:3.2.13-1.el6 |
| Red Hat rhel software collections 3 | rh-redis32-redis-debuginfo | 0:3.2.13-1.el7 |
| SUSE Linux Enterprise Module for Server Applications 15 SP2 | redis | 6.0.8-1.3.1 |
| Ubuntu 14.04 LTS | redis | 2:2.8.4-2ubuntu0.2 |
| Ubuntu 16.04 LTS | redis | 2:3.0.6-1ubuntu0.2 |
| Ubuntu 18.04 LTS | redis | 5:4.0.9-1ubuntu0.1 |
| openSUSE Tumbleweed | redis | 6.2.5-1.2 |