A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
28 Oct 2021, 12:14
Type | Values Removed | Values Added |
---|---|---|
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:1860 - Third Party Advisory | |
References | (GENTOO) https://security.gentoo.org/glsa/201908-04 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2506 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2508 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2002 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2630 - Third Party Advisory | |
References | (BID) http://www.securityfocus.com/bid/109290 - Third Party Advisory, VDB Entry | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2621 - Third Party Advisory | |
References | (MISC) https://www.oracle.com/security-alerts/cpujul2020.html - Patch, Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:1819 - Third Party Advisory | |
CWE | CWE-787 | |
CPE | cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* |
04 Aug 2021, 17:15
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:redhat:openstack:14.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:9.0:*:*:*:*:*:*:* |
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* |
Information
Published : 2019-07-11 19:15
Updated : 2023-12-10 12:59
NVD link : CVE-2019-10192
Mitre link : CVE-2019-10192
CVE.ORG link : CVE-2019-10192
JSON object : View
Products Affected
redislabs
- redis
oracle
- communications_operations_monitor
debian
- debian_linux
redhat
- enterprise_linux
- openstack
- enterprise_linux_server_aus
- enterprise_linux_server_tus
- enterprise_linux_eus
- software_collections
canonical
- ubuntu_linux