Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0094 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: code execution via a crafted command line (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0052 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: code execution via a crafted command line (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1860 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)

    * redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

    * redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

    * redis: Code execution in redis-cli via crafted command line arguments (CVE-2018-12326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Redis installed on the remote host is affected by multiple vulnerabilities and therefore requires a security update.

ID	Name	Product	Family	Severity
210278	RHEL 7 : redis (RHSA-2019:0094)	Nessus	Red Hat Local Security Checks	critical
194134	RHEL 7 : redis (RHSA-2019:0052)	Nessus	Red Hat Local Security Checks	critical
194107	RHEL 6 / 7 : rh-redis32-redis (RHSA-2019:1860)	Nessus	Red Hat Local Security Checks	critical
117484	Pivotal Software Redis LUA < 3.2.12 / 4.0.x < 4.0.10 / 5.0 < 5.0rc2 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2018-12326

high

Tenable Plugins

critical

critical

critical

critical