Vulnerability CVE-2019-10192: Information
Description
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
Severity: HIGH (7.2) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
---|---|---|---|---|---|---|
redis | sisyphus | 5.0.4-alt1 | 7.2.4-alt1.1 | ALT-PU-2019-1790-1 | 229175 | Fixed |
redis | p10 | 5.0.4-alt1 | 6.2.14-alt1 | ALT-PU-2019-1790-1 | 229175 | Fixed |
redis | p9 | 5.0.4-alt1 | 6.2.4-alt1 | ALT-PU-2019-1790-1 | 229175 | Fixed |
redis | p8 | 3.0.7-alt2 | 3.0.7-alt2 | ALT-PU-2019-3195-1 | 241717 | Fixed |
redis | c10f1 | 5.0.4-alt1 | 6.2.13-alt1 | ALT-PU-2019-1790-1 | 229175 | Fixed |
redis | c9f2 | 5.0.4-alt1 | 6.2.13-alt1 | ALT-PU-2019-1790-1 | 229175 | Fixed |
redis | p11 | 5.0.4-alt1 | 7.2.4-alt1.1 | ALT-PU-2019-1790-1 | 229175 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10192 |
|
https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES |
|
https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES |
|
https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES |
|
DSA-4480 |
|
20190712 [SECURITY] [DSA 4480-1] redis security update |
|
USN-4061-1 |
|
109290 |
|
RHSA-2019:1819 |
|
RHSA-2019:1860 |
|
RHSA-2019:2002 |
|
GLSA-201908-04 |
|
RHSA-2019:2508 |
|
RHSA-2019:2506 |
|
RHSA-2019:2621 |
|
RHSA-2019:2630 |
|
https://www.oracle.com/security-alerts/cpujul2020.html |
|