Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0094 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: code execution via a crafted command line (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0052 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: code execution via a crafted command line (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1860 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: Code execution in redis-cli via crafted command line arguments (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201908-04 (Redis: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Redis. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for redis to 4.0.10 fixes the following issues :

These security issues were fixed :

  - CVE-2018-11218: Prevent heap corruption vulnerability in     cmsgpack (bsc#1097430).

  - CVE-2018-11219: Prevent integer overflow in Lua     scripting (bsc#1097768).

For Leap 42.3 and openSUSE SLE 12 backports this is a jump from 4.0.6.
For additional details please see

- https://raw.githubusercontent.com/antirez/redis/4.0.9/00-RELEASENOTES

- https://raw.githubusercontent.com/antirez/redis/4.0.8/00-RELEASENOTES

- https://raw.githubusercontent.com/antirez/redis/4.0.7/00-RELEASENOTES

An update of the redis package has been released.

The version of Redis installed on the remote host is affected by multiple vulnerabilities and therefore requires a security update.

Multiple vulnerabilities were discovered in the Lua subsystem of Redis, a persistent key-value database, which could result in denial of service.

ID	Name	Product	Family	Severity
210278	RHEL 7 : redis (RHSA-2019:0094)	Nessus	Red Hat Local Security Checks	critical
194134	RHEL 7 : redis (RHSA-2019:0052)	Nessus	Red Hat Local Security Checks	critical
194107	RHEL 6 / 7 : rh-redis32-redis (RHSA-2019:1860)	Nessus	Red Hat Local Security Checks	critical
127562	GLSA-201908-04 : Redis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
123199	openSUSE Security Update : redis (openSUSE-2019-481)	Nessus	SuSE Local Security Checks	critical
121964	Photon OS 2.0: Redis PHSA-2018-2.0-0070	Nessus	PhotonOS Local Security Checks	critical
121854	Photon OS 1.0: Redis PHSA-2018-1.0-0156	Nessus	PhotonOS Local Security Checks	critical
117484	Pivotal Software Redis LUA < 3.2.12 / 4.0.x < 4.0.10 / 5.0 < 5.0rc2 Multiple Vulnerabilities	Nessus	Misc.	critical
110678	openSUSE Security Update : redis (openSUSE-2018-667)	Nessus	SuSE Local Security Checks	critical
110571	Debian DSA-4230-1 : redis - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-11218

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical