The version of Redis installed on the remote host is affected by multiple vulnerabilities and therefore requires a security update.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0052 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: code execution via a crafted command line (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the redis package has been released.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0094 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: code execution via a crafted command line (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for redis to 4.0.10 fixes the following issues :

These security issues were fixed :

  - CVE-2018-11218: Prevent heap corruption vulnerability in     cmsgpack (bsc#1097430).

  - CVE-2018-11219: Prevent integer overflow in Lua     scripting (bsc#1097768).

For Leap 42.3 and openSUSE SLE 12 backports this is a jump from 4.0.6.
For additional details please see

- https://raw.githubusercontent.com/antirez/redis/4.0.9/00-RELEASENOTES

- https://raw.githubusercontent.com/antirez/redis/4.0.8/00-RELEASENOTES

- https://raw.githubusercontent.com/antirez/redis/4.0.7/00-RELEASENOTES

Multiple vulnerabilities were discovered in the Lua subsystem of Redis, a persistent key-value database, which could result in denial of service.

The remote host is affected by the vulnerability described in GLSA-201908-04 (Redis: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Redis. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1860 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: Code execution in redis-cli via crafted command line arguments (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
117484	Pivotal Software Redis LUA < 3.2.12 / 4.0.x < 4.0.10 / 5.0 < 5.0rc2 Multiple Vulnerabilities	Nessus	Misc.	9/14/2018	4/11/2022	critical
194134	RHEL 7 : redis (RHSA-2019:0052)	Nessus	Red Hat Local Security Checks	4/27/2024	11/6/2024	critical
121854	Photon OS 1.0: Redis PHSA-2018-1.0-0156	Nessus	PhotonOS Local Security Checks	2/7/2019	6/21/2024	critical
210278	RHEL 7 : redis (RHSA-2019:0094)	Nessus	Red Hat Local Security Checks	11/5/2024	11/6/2024	critical
123199	openSUSE Security Update : redis (openSUSE-2019-481)	Nessus	SuSE Local Security Checks	3/27/2019	6/11/2024	critical
110571	Debian DSA-4230-1 : redis - security update	Nessus	Debian Local Security Checks	6/18/2018	9/20/2024	critical
110678	openSUSE Security Update : redis (openSUSE-2018-667)	Nessus	SuSE Local Security Checks	6/25/2018	9/16/2024	critical
121964	Photon OS 2.0: Redis PHSA-2018-2.0-0070	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	critical
127562	GLSA-201908-04 : Redis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/12/2019	5/7/2024	critical
194107	RHEL 6 / 7 : rh-redis32-redis (RHSA-2019:1860)	Nessus	Red Hat Local Security Checks	4/27/2024	11/6/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical