An update of the redis package has been released.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0052 advisory.

  - redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

  - redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

  - redis: Code execution in redis-cli via crafted command line arguments (CVE-2018-12326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in the Lua subsystem of Redis, a persistent key-value database, which could result in denial of service.

This update for redis to 4.0.10 fixes the following issues :

These security issues were fixed :

  - CVE-2018-11218: Prevent heap corruption vulnerability in     cmsgpack (bsc#1097430).

  - CVE-2018-11219: Prevent integer overflow in Lua     scripting (bsc#1097768).

For Leap 42.3 and openSUSE SLE 12 backports this is a jump from 4.0.6.
For additional details please see

- https://raw.githubusercontent.com/antirez/redis/4.0.9/00-RELEASENOTES

- https://raw.githubusercontent.com/antirez/redis/4.0.8/00-RELEASENOTES

- https://raw.githubusercontent.com/antirez/redis/4.0.7/00-RELEASENOTES

The remote host is affected by the vulnerability described in GLSA-201908-04 (Redis: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Redis. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1860 advisory.

  - redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

  - redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

  - redis: Code execution in redis-cli via crafted command line arguments (CVE-2018-12326)

  - redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
121854	Photon OS 1.0: Redis PHSA-2018-1.0-0156	Nessus	PhotonOS Local Security Checks	2/7/2019	2/7/2019	critical
194134	RHEL 7 : redis (RHSA-2019:0052)	Nessus	Red Hat Local Security Checks	4/27/2024	4/27/2024	critical
110571	Debian DSA-4230-1 : redis - security update	Nessus	Debian Local Security Checks	6/18/2018	11/13/2018	critical
110678	openSUSE Security Update : redis (openSUSE-2018-667)	Nessus	SuSE Local Security Checks	6/25/2018	1/19/2021	critical
123199	openSUSE Security Update : redis (openSUSE-2019-481)	Nessus	SuSE Local Security Checks	3/27/2019	1/19/2021	critical
121964	Photon OS 2.0: Redis PHSA-2018-2.0-0070	Nessus	PhotonOS Local Security Checks	2/7/2019	2/7/2019	critical
127562	GLSA-201908-04 : Redis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/12/2019	5/7/2024	critical
194107	RHEL 6 / 7 : rh-redis32-redis (RHSA-2019:1860)	Nessus	Red Hat Local Security Checks	4/27/2024	4/27/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical