CVE-2018-11218
- Source
- https://cve.org/CVERecord?id=CVE-2018-11218
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11218.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-11218
- Downstream
- Related
- Published
- 2018-06-17T17:29:00.277Z
- Modified
- 2026-02-06T05:09:07.403513Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
- References
-
- http://antirez.com/news/119
- http://www.securityfocus.com/bid/104553
- https://access.redhat.com/errata/RHSA-2019:0052
- https://access.redhat.com/errata/RHSA-2019:0094
- https://access.redhat.com/errata/RHSA-2019:1860
- https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3
- https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0
- https://github.com/antirez/redis/issues/5017
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- https://security.gentoo.org/glsa/201908-04
- https://www.debian.org/security/2018/dsa-4230
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3
- https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- http://antirez.com/news/119
- https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3
Affected packages
Git / github.com/antirez/redis
Affected ranges
- Type
- GIT
- Repo
- https://github.com/antirez/redis
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Database specific
vanir_signatures
[
{
"deprecated": false,
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"id": "CVE-2018-11218-2b05667f",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c"
},
"digest": {
"line_hashes": [
"337766185303747225584829759257532524896",
"269585019922283674827343408182435343615",
"276347650036692000891895548078094052707",
"88582443100287800726424792687028816609",
"215777682687045503648306437104834133475",
"315333490960664396032101522782947153987",
"10910213948860138306909571335153854827",
"28783296134346588523338121042580242026",
"279852048722243758705988283443776485073",
"212853258189081442450138799002831747316",
"323913027355331421238764094451433662322",
"154914356849450609493502313672812439413",
"74789942888360740357788701470883649993",
"240347877613534950699364977574334514996",
"269122171257432780629855963042852510175",
"125419494530020957839546715759395098309",
"22534044122641578125746183834446652944",
"126408283396505436829412180114435961825"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"id": "CVE-2018-11218-2f74bf2c",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_pack"
},
"digest": {
"function_hash": "190332315271629174314866782873653742877",
"length": 582.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"id": "CVE-2018-11218-3d8a2ad2",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_encode_lua_table_as_map"
},
"digest": {
"function_hash": "8580406164265631604237048477084312894",
"length": 380.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"id": "CVE-2018-11218-445ec40c",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_encode_lua_table_as_array"
},
"digest": {
"function_hash": "68377607274585305145251627420235568498",
"length": 372.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3",
"id": "CVE-2018-11218-700a840d",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c"
},
"digest": {
"line_hashes": [
"16911033430593959714276436254180720746",
"118647126258626533724160258916734123784",
"266997613451356111695635551196073534977"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"id": "CVE-2018-11218-cbc76614",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_unpack_full"
},
"digest": {
"function_hash": "90928435928387655241801909522494201752",
"length": 980.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3",
"id": "CVE-2018-11218-d30d5814",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_pack"
},
"digest": {
"function_hash": "311114601621233800883377513176254974414",
"length": 471.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0",
"id": "CVE-2018-11218-ef10caed",
"target": {
"file": "deps/lua/src/lua_cmsgpack.c",
"function": "mp_decode_to_lua_array"
},
"digest": {
"function_hash": "14712776452728800459135148564539305452",
"length": 274.0
},
"signature_type": "Function",
"signature_version": "v1"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11218.json"