CVE-2018-11218

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.

References

Affected packages

Git / github.com/antirez/redis

Affected ranges

Type: GIT
Repo: https://github.com/antirez/redis
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

52a00201fca331217c3b4b8b634f6a0f57d6b7d3

Fixed

5ccb6f7a791bf3490357b00a898885759d98bab0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11218.json"

vanir_signatures

[
    {
        "id": "CVE-2018-11218-700a840d",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "16911033430593959714276436254180720746",
                "118647126258626533724160258916734123784",
                "266997613451356111695635551196073534977"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3",
        "target": {
            "file": "deps/lua/src/lua_cmsgpack.c"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2018-11218-d30d5814",
        "signature_type": "Function",
        "digest": {
            "function_hash": "311114601621233800883377513176254974414",
            "length": 471.0
        },
        "signature_version": "v1",
        "source": "https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3",
        "target": {
            "function": "mp_pack",
            "file": "deps/lua/src/lua_cmsgpack.c"
        },
        "deprecated": false
    }
]

Git / github.com/redis/redis

Affected ranges

Type: GIT
Repo: https://github.com/redis/redis
Events: Introduced

05b81d2b02578d432329c87c93f975e582d14c0e

Fixed

556b2d2bee22d1307e696090c9be10fc10a47cd3

Fixed

590f537420e81832c3893418e608cd6ab3cc7c5f

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11218.json"