Critical Memory Corruption Vulnerability in Redis Package
Summary
ALPINE-CVE-2018-11218: Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows. Affects redis versions < 3.2.12-r0. Fixed in 3.2.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open-source in-memory data structure store, used as a database, cache, and message broker. It supports various data structures such as strings, hashes, lists, sets, and more. Redis is known for its high performance, flexibility, and ease of use. However, it has been found to be vulnerable to a memory corruption issue due to flaws in the cmsgpack library within its Lua subsystem, affecting versions prior to 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2.
Vulnerability Detail
The vulnerability arises from stack-based buffer overflows in the cmsgpack library, which can lead to memory corruption. This can potentially allow an attacker to execute arbitrary code, leading to unauthorized access or denial of service. The issue is particularly severe, with a CVSS score of 9.8, indicating critical risk. The vulnerability affects multiple versions of Redis, making it imperative for users to address it promptly.
How To Fix
Minimum fixed version
3.2.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the Redis server by configuring firewall rules to restrict incoming connections or by using Redis's built-in authentication features to secure access until the package is updated.
Conclusion
The Redis package has a critical memory corruption vulnerability that affects multiple versions. Users are strongly advised to update to the patched versions to mitigate the risk of exploitation. Implementing the suggested workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for redis →
FAQ
The vulnerability is a memory corruption issue caused by stack-based buffer overflows in the cmsgpack library within Redis.
Redis versions prior to 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 are affected by this vulnerability.
Exploitation of this vulnerability could lead to arbitrary code execution, unauthorized access, or denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical risk level.
References
Related vulnerabilities
Recent vulnerabilities recorded for redis.
