CVE-2018-12453

Published: Jun 16, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.

Affected (1)

Products: Redislabs: Redis

Redislabs

1 product

Redis

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redislabs Redis	Before 5.0

Related CWEs

CWE-704

Incorrect Type Conversion or Cast

The product does not correctly convert an object, resource, or structure from one type to a different type.

References (6)

https://gist.github.com/fakhrizulkifli/34a56d575030682f6c564553c53b82b5

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/antirez/redis/commit/c04082cf138f1f51cedf05ee9ad36fb6763cafc6

Source: cve@mitre.org

PatchThird Party Advisory

https://www.exploit-db.com/exploits/44908/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://gist.github.com/fakhrizulkifli/34a56d575030682f6c564553c53b82b5

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/antirez/redis/commit/c04082cf138f1f51cedf05ee9ad36fb6763cafc6

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.exploit-db.com/exploits/44908/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.