CVE-2018-11218
- Source
- https://cve.org/CVERecord?id=CVE-2018-11218
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11218.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-11218
- Downstream
ALPINE (1)
MGASA (1)
openSUSE (1)
SUSE (1)
UBUNTU (1)
- Related
- Published
- 2018-06-17T17:29:00Z
- Modified
- 2026-10-24T14:10:57Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "9.0" }, { "last_affected": "9.0" } ], "source": "CPE_STRING" } ], "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "3.4" }, { "last_affected": "3.4" }, { "introduced": "4.0" }, { "last_affected": "4.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:communications_operations_monitor" }, { "cpes": [ "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "10" }, { "last_affected": "10" }, { "introduced": "13" }, { "last_affected": "13" } ], "source": "CPE_STRING" } ], "vendor_product": "redhat:openstack" } ] }- References
-
- http://www.securityfocus.com/bid/104553
- https://access.redhat.com/errata/RHSA-2019:0052
- https://access.redhat.com/errata/RHSA-2019:0094
- https://access.redhat.com/errata/RHSA-2019:1860
- https://github.com/antirez/redis/issues/5017
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- https://security.gentoo.org/glsa/201908-04
- https://www.debian.org/security/2018/dsa-4230
- https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3
- https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- http://antirez.com/news/119
Affected packages
Git / github.com/antirez/redis
Affected ranges
- Type
- GIT
- Repo
- https://github.com/antirez/redis
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "fixed": "52a00201fca331217c3b4b8b634f6a0f57d6b7d3" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "5ccb6f7a791bf3490357b00a898885759d98bab0" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11218.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"337766185303747225584829759257532524896",
"269585019922283674827343408182435343615",
"276347650036692000891895548078094052707",
"88582443100287800726424792687028816609",
"215777682687045503648306437104834133475",
"315333490960664396032101522782947153987",
"10910213948860138306909571335153854827",
"28783296134346588523338121042580242026",
"279852048722243758705988283443776485073",
"212853258189081442450138799002831747316",
"323913027355331421238764094451433662322",
"154914356849450609493502313672812439413",
"74789942888360740357788701470883649993",
"240347877613534950699364977574334514996",
"269122171257432780629855963042852510175",
"125419494530020957839546715759395098309",
"22534044122641578125746183834446652944",
"126408283396505436829412180114435961825"
],
"threshold": 0.9
},
"id": "CVE-2018-11218-2b05667f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "190332315271629174314866782873653742877",
"length": 582
},
"id": "CVE-2018-11218-2f74bf2c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_pack"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "8580406164265631604237048477084312894",
"length": 380
},
"id": "CVE-2018-11218-3d8a2ad2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_encode_lua_table_as_map"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "68377607274585305145251627420235568498",
"length": 372
},
"id": "CVE-2018-11218-445ec40c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_encode_lua_table_as_array"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"16911033430593959714276436254180720746",
"118647126258626533724160258916734123784",
"266997613451356111695635551196073534977"
],
"threshold": 0.9
},
"id": "CVE-2018-11218-700a840d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "90928435928387655241801909522494201752",
"length": 980
},
"id": "CVE-2018-11218-cbc76614",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_unpack_full"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "311114601621233800883377513176254974414",
"length": 471
},
"id": "CVE-2018-11218-d30d5814",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_pack"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "14712776452728800459135148564539305452",
"length": 274
},
"id": "CVE-2018-11218-ef10caed",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_decode_to_lua_array"
}
}
]
vanir_signatures_modified
"2026-10-24T14:10:57Z"
Git / github.com/redis/redis
Affected ranges
- Type
- GIT
- Repo
- https://github.com/redis/redis
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "3.2.12" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.0" }, { "fixed": "4.0.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:redislabs:redis:5.0:rc1:*:*:*:*:*:*", "range": [ { "introduced": "5.0-rc1" }, { "last_affected": "5.0-rc1" } ], "source": "CPE_STRING" } ] }
Affected versions
1.*
1.3.6
2.*
2.2-alpha0
2.2-alpha1
2.2-alpha2
2.2-alpha3
2.2-alpha4
2.2-alpha5
2.2-alpha6
2.2.0-rc1
2.3-alpha0
3.*
3.2-rc1
3.2.0
3.2.0-rc2
3.2.0-rc3
3.2.1
3.2.10
3.2.11
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.*
5.0-rc1
v1.*
v1.3.10
v1.3.11
v1.3.7
v1.3.8
v1.3.9
v2.*
v2.0.0-rc1
v2.1.1-watch
Other
vm-playpen