Red Hat Security AdvisoryRHSA-2019:1860
rh-redis32-redis security update
Released 2019-07-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-redis32-redis-3.2.13-1.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-redis32-redis-3.2.13-1.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-redis32-redis-3.2.13-1.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-redis32-redis-3.2.13-1.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-redis32-redis-3.2.13-1.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-redis32-redis-3.2.13-1.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-redis32-redis-3.2.13-1.el7
Fixes 4 records
Priority HIGH 76
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.58827 · Published 2018-06-17 · Partial fix CWE-787
Priority MEDIUM 53
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.25616 · Published 2019-07-11 · Fixed in 3.2.13, 4.0.14 +1 CWE-122
Priority MEDIUM 52
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06722 · Published 2018-06-17 · Partial fix CWE-190
Priority MEDIUM 41
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line.
CVSS 3.0HIGH 8.4· Local · No auth · No interaction · EPSS 0.02582 · Published 2018-06-17 · Partial fix CWE-119
THREATIST.IORead the docs