| Vulnerability Name: | CVE-2018-12326 (CCN-144908) | ||||||||||||||||||||||||||||||||||||
| Assigned: | 2018-06-17 | ||||||||||||||||||||||||||||||||||||
| Published: | 2018-06-17 | ||||||||||||||||||||||||||||||||||||
| Updated: | 2019-01-17 | ||||||||||||||||||||||||||||||||||||
| Summary: | Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. Note: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source. | ||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 8.4 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 7.8 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
7.8 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-119 | ||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-12326 Source: REDHAT Type: UNKNOWN RHSA-2019:0052 Source: REDHAT Type: UNKNOWN RHSA-2019:0094 Source: REDHAT Type: UNKNOWN RHSA-2019:1860 Source: XF Type: UNKNOWN redis-cve201812326-bo(144908) Source: MISC Type: Third Party Advisory https://gist.github.com/fakhrizulkifli/f831f40ec6cde4f744c552503d8698f0 Source: CCN Type: Redis GIT Repository fix redis-cli buffer overflow Source: MISC Type: Patch, Third Party Advisory https://github.com/antirez/redis/commit/9fdcc15962f9ff4baebe6fdd947816f43f730d50 Source: CCN Type: Packet Storm Security [06-18-2018] Redis-cli Buffer Overflow Source: MISC Type: Patch, Third Party Advisory https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES Source: MISC Type: Patch, Third Party Advisory https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [06-18-2018] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 44904 Source: CCN Type: IBM Security Bulletin 1143436 (Watson Studio Local) Multiple Vulnerabilities In Redis affects Watson Studio Local (CVE-2018-12453, CVE-2018-12326, CVE-2018-11218) | ||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||