CVE-2018-11218
redis: Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0....
CVE-2018-11218 is fixed in 4 products on 1 platform, first by redis 5:4.0.9-1ubuntu0.1, released June 17, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.5883
99th percentile
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| redis · Ubuntu 18.04.6 LTS (bionic) | 5:4.0.9-1ubuntu0.1 | redis 5:4.0.9-1ubuntu0.1 | Jun 17, 2018 |
| redis-sentinel · Ubuntu 18.04.6 LTS (bionic) | 5:4.0.9-1ubuntu0.1 | redis-sentinel 5:4.0.9-1ubuntu0.1 | Jun 17, 2018 |
| redis-server · Ubuntu 18.04.6 LTS (bionic) | 5:4.0.9-1ubuntu0.1 | redis-server 5:4.0.9-1ubuntu0.1 | Jun 17, 2018 |
| redis-tools · Ubuntu 18.04.6 LTS (bionic) | 5:4.0.9-1ubuntu0.1 | redis-tools 5:4.0.9-1ubuntu0.1 | Jun 17, 2018 |