NetSight
IP …
high7.2

CVE-2019-10192

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4.

Impact

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

Affected products

VendorProductAffected versions
RedislabsRedis
from 3.0.0 before 3.2.13
from 4.0.0 before 4.0.14
from 5.0 before 5.0.4
RedhatOpenstack
Versions 9, 10, 13, 14
RedhatSoftware Collections
Version 1.0
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Eus
Versions 8.1, 8.2, 8.4
RedhatEnterprise Linux Server Aus
Versions 8.2, 8.4
RedhatEnterprise Linux Server Tus
Versions 8.2, 8.4
DebianDebian Linux
Versions 9.0, 10.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04
OracleCommunications Operations Monitor
Versions 3.4, 4.1

Weakness classification

CWE-122CWE-787

References