7.5 - RHSA-2019:0094

Problem Description:

An update for redis is now available for Red Hat OpenStack Platform 13.0 (Queens).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 13.0 - ppc64le, x86_64

3. Description:

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Heap corruption in lua_cmsgpack.c (CVE-2018-11218)

* redis: Integer overflow in lua_struct.c:b_unpack() (CVE-2018-11219)

* redis: code execution via a crafted command line (CVE-2018-12326)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1590062 - CVE-2018-11219 redis: Integer overflow in lua_struct.c:b_unpack() 1590067 - CVE-2018-11218 redis: Heap corruption in lua_cmsgpack.c 1594291 - CVE-2018-12326 redis: code execution via a crafted command line