Red Hat Security AdvisoryRHSA-2019:0094
redis security update
Released 2019-01-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenStack Platform 13.0 redis-3.2.8-3.el7ost
Fixes 3 records
Priority HIGH 76
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.58827 · Published 2018-06-17 · Partial fix CWE-787
Priority MEDIUM 52
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06722 · Published 2018-06-17 · Partial fix CWE-190
Priority MEDIUM 41
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line.
CVSS 3.0HIGH 8.4· Local · No auth · No interaction · EPSS 0.02582 · Published 2018-06-17 · Partial fix CWE-119
