Critical Integer Overflow Vulnerability in Redis Package
Summary
ALPINE-CVE-2018-11219: An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking. Affects redis versions < 3.2.12-r0. Fixed in 3.2.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Redis is an open-source, in-memory data structure store, used as a database, cache, and message broker. It supports various data structures such as strings, hashes, lists, sets, and more. Redis is known for its performance, flexibility, and ease of use. However, it has been found to be vulnerable to an integer overflow issue in its Lua subsystem, which can lead to severe security implications if not addressed.
Vulnerability Detail
An Integer Overflow issue was discovered in the struct library in the Lua subsystem of Redis prior to versions 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2. This vulnerability can lead to a failure of bounds checking, potentially allowing an attacker to exploit the flaw and execute arbitrary code, resulting in data corruption or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
3.2.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Redis server by configuring firewall rules to limit connections to trusted IP addresses only. Additionally, consider disabling Lua scripting if it is not required for your application.
Conclusion
The Integer Overflow vulnerability in Redis poses significant risks to applications using affected versions. It is crucial to update to the patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for redis →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Exploitation of this vulnerability could lead to arbitrary code execution, data corruption, or unauthorized access to sensitive information.
Yes, versions 3.2.12 and 4.0.10 or later are considered safe as they contain the necessary patches to address this vulnerability.
If immediate updates are not possible, implement firewall rules to restrict access and consider disabling Lua scripting as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for redis.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
