CVE-2018-11219
Publication date 17 June 2018
Last updated 25 August 2025
Ubuntu priority
Description
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
From the Ubuntu Security Team
It was discovered that Redis incorrectly handled integers. An attacker could possibly use this issue to cause a denial of service.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| redis | ||
| 18.04 LTS bionic |
Fixed 5:4.0.9-1ubuntu0.1
|
|
| 16.04 LTS xenial |
Fixed 2:3.0.6-1ubuntu0.2
|
|
| 14.04 LTS trusty |
Fixed 2:2.8.4-2ubuntu0.2
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.8 · Critical
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Other references
- https://github.com/antirez/redis/issues/5017
- http://antirez.com/news/119
- https://github.com/antirez/redis/commit/1eb08bcd4634ae42ec45e8284923ac048beaa4c3
- https://github.com/antirez/redis/commit/e89086e09a38cc6713bcd4b9c29abf92cf393936
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- https://www.debian.org/security/2018/dsa-4230
- https://www.cve.org/CVERecord?id=CVE-2018-11219