CVE-2018-11218
Publication date 17 June 2018
Last updated 25 August 2025
Ubuntu priority
Description
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
From the Ubuntu Security Team
It was discovered that Redis incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| redis | ||
| 18.04 LTS bionic |
Fixed 5:4.0.9-1ubuntu0.1
|
|
| 16.04 LTS xenial |
Fixed 2:3.0.6-1ubuntu0.2
|
|
| 14.04 LTS trusty |
Fixed 2:2.8.4-2ubuntu0.2
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.8 · Critical
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Other references
- https://github.com/antirez/redis/issues/5017
- http://antirez.com/news/119
- https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3
- https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- https://www.debian.org/security/2018/dsa-4230
- https://www.cve.org/CVERecord?id=CVE-2018-11218