VDB
CVE-2019-10192
CVE-2019-10192
PUBLISHED
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
EPSS 22.31% · 95.9th percentile
Risk Scores
EPSS Score
22.31%
95.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | redis | 0, 4:4.0.1-7, 4:4.0.2-9 |
| Ubuntu:16.04:LTS | redis | *, *, 2:3.0.5-2 |
Timeline
- Jul 11, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 28, 2023 EPSS Score
- Apr 30, 2023 EPSS Score
- Aug 20, 2023 EPSS Score
- Nov 4, 2023 EPSS Score
- Jan 7, 2024 EPSS Score
- Apr 30, 2024 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-10192 third-party-advisory
- https://github.com/antirez/redis/issues/6215 third-party-advisory
- https://github.com/antirez/redis/commit/e216ceaf0e099536fe3658a29dcb725d812364e0 third-party-advisory
- https://github.com/antirez/redis/commit/9f13b2bd4967334b1701c6eccdf53760cb13f79e third-party-advisory
- https://github.com/antirez/redis/commit/ef1833b3f9d02261617b757fd6ebe0ec3f1be507 third-party-advisory
- https://github.com/antirez/redis/commit/7f79849caa006f0d760b6c7e17f7796e3be92b4f third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10192 third-party-advisory
- https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES third-party-advisory
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES third-party-advisory
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES third-party-advisory
- https://ubuntu.com/security/notices/USN-4061-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-10192 third-party-advisory