Vulnerability Name:

CVE-2018-11219 (CCN-145103)

Assigned:2018-06-14
Published:2018-06-14
Updated:2021-08-04
Summary:An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-190
Vulnerability Consequences:Denial of Service
References:Source: MISC
Type: Exploit, Third Party Advisory
http://antirez.com/news/119

Source: MITRE
Type: CNA
CVE-2018-11219

Source: CCN
Type: Oracle CPUApr2019
Oracle Critical Patch Update Advisory - April 2019

Source: BID
Type: Third Party Advisory, VDB Entry
104552

Source: CCN
Type: BID-104552
Redis CVE-2018-11219 Integer Overflow Vulnerability

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:0052

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:0094

Source: REDHAT
Type: UNKNOWN
RHSA-2019:1860

Source: XF
Type: UNKNOWN
redis-cve201811219-bo(145103)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/antirez/redis/commit/1eb08bcd4634ae42ec45e8284923ac048beaa4c3

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/antirez/redis/commit/e89086e09a38cc6713bcd4b9c29abf92cf393936

Source: CCN
Type: Redis GIT Repository
Redis Lua scripting: multiple security issues #5017

Source: MISC
Type: Third Party Advisory
https://github.com/antirez/redis/issues/5017

Source: MISC
Type: Third Party Advisory
https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES

Source: MISC
Type: Third Party Advisory
https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES

Source: GENTOO
Type: UNKNOWN
GLSA-201908-04

Source: DEBIAN
Type: Third Party Advisory
DSA-4230

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2018-11219

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redislabs:redis:*:*:*:*:*:*:*:* (Version < 3.2.12)
  • OR cpe:/a:redislabs:redis:*:*:*:*:*:*:*:* (Version >= 4.0 and < 4.0.10)
  • OR cpe:/a:redislabs:redis:5.0:rc1:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:redhat:openstack:10:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:openstack:13:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:redislabs:redis:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:redislabs:redis:3.2.11:*:*:*:*:*:*:*
  • OR cpe:/a:redislabs:redis:4.0.9:*:*:*:*:*:*:*
  • AND
  • cpe:/a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:619
    P
    		Security update for php8 (Important) (in QA)
    2022-10-03
    oval:org.opensuse.security:def:201811219
    V
    		CVE-2018-11219
    2022-09-02
    oval:org.opensuse.security:def:3519
    P
    		gv-3.7.4-1.36 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95149
    P
    		redis-6.2.6-150400.1.5 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:101395
    P
    		redis-6.0.10-1.7.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:2280
    P
    		redis-6.0.10-1.7.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63369
    P
    		redis-6.0.10-1.7.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:26432
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25361
    P
    		Security update for tomcat (Important)
    2020-12-01
    oval:org.opensuse.security:def:25736
    P
    		Security update for mozilla-nspr, mozilla-nss (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25096
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26467
    P
    		Security update for redis (Important)
    2020-12-01
    oval:org.opensuse.security:def:25445
    P
    		Security update for accountsservice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25750
    P
    		Security update for flash-player (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25223
    P
    		Security update for openssl-1_0_0 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25595
    P
    		Security update for java-1_8_0-ibm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25021
    P
    		Security update for openldap2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25794
    P
    		Security update for libssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25304
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25648
    P
    		Security update for python36 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25032
    P
    		Security update for bind (Important)
    2020-12-01
    oval:com.ubuntu.bionic:def:2018112190000000
    V
    		CVE-2018-11219 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-06-17
    oval:com.ubuntu.artful:def:201811219000
    V
    		CVE-2018-11219 on Ubuntu 17.10 (artful) - medium.
    2018-06-17
    oval:com.ubuntu.xenial:def:201811219000
    V
    		CVE-2018-11219 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-06-17
    oval:com.ubuntu.xenial:def:2018112190000000
    V
    		CVE-2018-11219 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-06-17
    oval:com.ubuntu.bionic:def:201811219000
    V
    		CVE-2018-11219 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-06-17
    oval:com.ubuntu.cosmic:def:201811219000
    V
    		CVE-2018-11219 on Ubuntu 18.10 (cosmic) - medium.
    2018-06-17
    oval:com.ubuntu.cosmic:def:2018112190000000
    V
    		CVE-2018-11219 on Ubuntu 18.10 (cosmic) - medium.
    2018-06-17
    oval:com.ubuntu.trusty:def:201811219000
    V
    		CVE-2018-11219 on Ubuntu 14.04 LTS (trusty) - medium.
    2018-06-17
    BACK
    redislabs redis *
    redislabs redis *
    redislabs redis 5.0 rc1
    debian debian linux 9.0
    oracle communications operations monitor 4.0
    oracle communications operations monitor 3.4
    redhat openstack 10
    redhat openstack 13
    redislabs redis 5.0
    redislabs redis 3.2.11
    redislabs redis 4.0.9
    oracle communications operations monitor 3.4
    oracle communications operations monitor 4.0