kritik
CVE-2018-11219
redis: Integer overflow in lua_struct.c:b_unpack()
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Photon OS. Daha düşük diyenler: Red Hat (orta), Ubuntu (orta).
Açıklama
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | redis | 4.0.10-1.ph1 |
| Photon OS 2.0 | redis | 4.0.10-1.ph2 |
| alpine 3.5 | redis | 3.2.12-r0 |
| alpine 3.6 | redis | 3.2.12-r0 |
| alpine 3.7 | redis | 4.0.10-r0 |
| debian 11 | redis | 5:4.0.10-1 |
| debian 12 | redis | 5:4.0.10-1 |
| debian 13 | redis | 5:4.0.10-1 |
| debian 14 | redis | 5:4.0.10-1 |
| debian 8 | redis | 2:2.8.17-1+deb8u6 |
| debian 9 | redis | 3:3.2.6-3+deb9u1 |
| echo | redis | 5:4.0.10-1 |
19 kaynaktaki 19 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | redis | 4.0.10-1.ph1 |
| Photon OS 2.0 | redis | 4.0.10-1.ph2 |
| alpine 3.5 | redis | 3.2.12-r0 |
| alpine 3.6 | redis | 3.2.12-r0 |
| alpine 3.7 | redis | 4.0.10-r0 |
| debian 11 | redis | 5:4.0.10-1 |
| debian 12 | redis | 5:4.0.10-1 |
| debian 13 | redis | 5:4.0.10-1 |
| debian 14 | redis | 5:4.0.10-1 |
| debian 8 | redis | 2:2.8.17-1+deb8u6 |
| debian 9 | redis | 3:3.2.6-3+deb9u1 |
| echo | redis | 5:4.0.10-1 |
| Red Hat | redis | düzeltme belirtilmemiş |
| ubuntu 14.04 | redis | 2:2.8.4-2ubuntu0.2 |
| ubuntu 14.04-ESM | redis | 2:2.8.4-2ubuntu0.2 |
| ubuntu 16.04 | redis | 2:3.0.6-1ubuntu0.2 |
| ubuntu 16.04-ESM | redis | 2:3.0.6-1ubuntu0.2 |
| ubuntu 18.04 | redis | 5:4.0.9-1ubuntu0.1 |
| ubuntu 18.04-ESM | redis | 5:4.0.9-1ubuntu0.1 |
Referanslar
- http://antirez.com/news/119
- http://www.securityfocus.com/bid/104552
- https://access.redhat.com/errata/RHSA-2019:0052
- https://access.redhat.com/errata/RHSA-2019:0094
- https://access.redhat.com/errata/RHSA-2019:1860
- https://access.redhat.com/security/cve/CVE-2018-11219
- https://github.com/antirez/redis/commit/1eb08bcd4634ae42ec45e8284923ac048beaa4c3
- https://github.com/antirez/redis/commit/e89086e09a38cc6713bcd4b9c29abf92cf393936
16 referansın hepsi
- https://github.com/antirez/redis/issues/5017
- https://nvd.nist.gov/vuln/detail/CVE-2018-11219
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- https://security.gentoo.org/glsa/201908-04
- https://www.cve.org/CVERecord?id=CVE-2018-11219
- https://www.debian.org/security/2018/dsa-4230
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html