CVE-2019-10192

HIGHScheduled

Published:Jul 11, 2019(6 years ago)

Modified:Nov 21, 2024

Remote ExploitNo InteractionLow Complexity

Vulnerability Description

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

Attack Characteristics

Network AccessLow ComplexityHigh PrivilegesNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

No Fix Known

No patch has been released yet. Apply workarounds or mitigations where available.

Affected Software

Vendor	Product	Versions	Fixed In
redislabs	redis	3.0.0 - 3.2.13	-
redislabs	redis	4.0.0 - 4.0.14	-
redislabs	redis	5.0 - 5.0.4

Timeline

Published
CVE disclosed publicly
Jul 11, 20196 years ago
Last Modified
Most recent update
Nov 21, 20241 year ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20261 month ago

References

http://www.securityfocus.com/bid/109290Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1819Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1860Third Party Advisory

CVSS Score

v3.1

7.2/ 10.0

HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

At a Glance

Affected Products

References

redislabs / redis

https://access.redhat.com/errata/RHSA-2019:2002Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2506Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2508Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2621Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2630Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10192Issue Tracking

https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTESRelease Notes

https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTESRelease Notes

https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTESRelease Notes

https://seclists.org/bugtraq/2019/Jul/19Mailing List

https://security.gentoo.org/glsa/201908-04Third Party Advisory

https://usn.ubuntu.com/4061-1/Third Party Advisory

https://www.debian.org/security/2019/dsa-4480Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.htmlPatch

http://www.securityfocus.com/bid/109290Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1819Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1860Third Party Advisory