CVE-2019-10192: Buffer Overflow
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
Other sources
Heap buffer overflow with corrupted hyperloglog data structure. By carefully corrupting a hyperloglog structure in redis using the SETRANGE command, an attacker could trick redis' interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
Upstream patches: https://github.com/antirez/redis/commit/e216ceaf0e099536fe3658a29dcb725d812364e0 https://github.com/antirez/redis/commit/9f13b2bd4967334b1701c6eccdf53760cb13f79e
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10192?
The severity of CVE-2019-10192 is high, with a severity value of 7.2.
Which versions of Redis are affected by CVE-2019-10192?
The Redis versions 3.x before 3.2.13, 4.x before 4.0.14, and 5.x before 5.0.4 are affected by CVE-2019-10192.
How can an attacker exploit the vulnerability in CVE-2019-10192?
An attacker can exploit the vulnerability in CVE-2019-10192 by carefully corrupting a hyperloglog using the SETRANGE command.
Is there a fix available for CVE-2019-10192?
Yes, there are fixes available for CVE-2019-10192. Please refer to the references for more information.
Where can I find more information about CVE-2019-10192?
You can find more information about CVE-2019-10192 in the provided references.