A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/109290 | Third Party Advisory VDB Entry |
| https://access.redhat.com/errata/RHSA-2019:1819 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2002 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10193 | Issue Tracking Third Party Advisory |
| https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES | Release Notes Vendor Advisory |
| https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES | Release Notes Vendor Advisory |
| https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES | Release Notes Vendor Advisory |
| https://seclists.org/bugtraq/2019/Jul/19 | Mailing List Third Party Advisory |
| https://security.gentoo.org/glsa/201908-04 | Third Party Advisory |
| https://usn.ubuntu.com/4061-1/ | Third Party Advisory |
| https://www.debian.org/security/2019/dsa-4480 | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2020.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
28 Oct 2021, 12:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | (GENTOO) https://security.gentoo.org/glsa/201908-04 - Third Party Advisory | |
| References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2002 - Third Party Advisory | |
| References | (BID) http://www.securityfocus.com/bid/109290 - Third Party Advisory, VDB Entry | |
| References | (MISC) https://www.oracle.com/security-alerts/cpujul2020.html - Patch, Third Party Advisory | |
| References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:1819 - Third Party Advisory | |
| CPE | cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* |
|
| CWE | CWE-787 |
04 Aug 2021, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:openstack:14.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:9.0:*:*:*:*:*:*:* |
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* |
Information
Published : 2019-07-11 19:15
Updated : 2023-12-10 12:59
NVD link : CVE-2019-10193
Mitre link : CVE-2019-10193
CVE.ORG link : CVE-2019-10193
JSON object : View
Products Affected
oracle
- communications_operations_monitor
debian
- debian_linux
redhat
- enterprise_linux
- enterprise_linux_server_aus
- openstack
- enterprise_linux_server_tus
- enterprise_linux_eus
redislabs
- redis
canonical
- ubuntu_linux