crítica
CVE-2018-11219
redis: Integer overflow in lua_struct.c:b_unpack()
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Red Hat (media), Ubuntu (media).
Descripción
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | redis | 4.0.10-1.ph1 |
| Photon OS 2.0 | redis | 4.0.10-1.ph2 |
| alpine 3.5 | redis | 3.2.12-r0 |
| alpine 3.6 | redis | 3.2.12-r0 |
| alpine 3.7 | redis | 4.0.10-r0 |
| debian 11 | redis | 5:4.0.10-1 |
| debian 12 | redis | 5:4.0.10-1 |
| debian 13 | redis | 5:4.0.10-1 |
| debian 14 | redis | 5:4.0.10-1 |
| debian 8 | redis | 2:2.8.17-1+deb8u6 |
| debian 9 | redis | 3:3.2.6-3+deb9u1 |
| echo | redis | 5:4.0.10-1 |
Mostrar las 19 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | redis | 4.0.10-1.ph1 |
| Photon OS 2.0 | redis | 4.0.10-1.ph2 |
| alpine 3.5 | redis | 3.2.12-r0 |
| alpine 3.6 | redis | 3.2.12-r0 |
| alpine 3.7 | redis | 4.0.10-r0 |
| debian 11 | redis | 5:4.0.10-1 |
| debian 12 | redis | 5:4.0.10-1 |
| debian 13 | redis | 5:4.0.10-1 |
| debian 14 | redis | 5:4.0.10-1 |
| debian 8 | redis | 2:2.8.17-1+deb8u6 |
| debian 9 | redis | 3:3.2.6-3+deb9u1 |
| echo | redis | 5:4.0.10-1 |
| Red Hat | redis | sin corrección indicada |
| ubuntu 14.04 | redis | 2:2.8.4-2ubuntu0.2 |
| ubuntu 14.04-ESM | redis | 2:2.8.4-2ubuntu0.2 |
| ubuntu 16.04 | redis | 2:3.0.6-1ubuntu0.2 |
| ubuntu 16.04-ESM | redis | 2:3.0.6-1ubuntu0.2 |
| ubuntu 18.04 | redis | 5:4.0.9-1ubuntu0.1 |
| ubuntu 18.04-ESM | redis | 5:4.0.9-1ubuntu0.1 |
Referencias
- http://antirez.com/news/119
- http://www.securityfocus.com/bid/104552
- https://access.redhat.com/errata/RHSA-2019:0052
- https://access.redhat.com/errata/RHSA-2019:0094
- https://access.redhat.com/errata/RHSA-2019:1860
- https://access.redhat.com/security/cve/CVE-2018-11219
- https://github.com/antirez/redis/commit/1eb08bcd4634ae42ec45e8284923ac048beaa4c3
- https://github.com/antirez/redis/commit/e89086e09a38cc6713bcd4b9c29abf92cf393936
Las 16 referencias
- https://github.com/antirez/redis/issues/5017
- https://nvd.nist.gov/vuln/detail/CVE-2018-11219
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- https://security.gentoo.org/glsa/201908-04
- https://www.cve.org/CVERecord?id=CVE-2018-11219
- https://www.debian.org/security/2018/dsa-4230
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html