VDB
CVE-2019-10192
CVE-2019-10192
PUBLISHED
CVSS 7.199999809265137 HIGH
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
EPSS 26.05% · 97.9th percentile
Risk Scores
CVSS 3.1
7.199999809265137
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score
26.05%
97.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | redis | 0, 4:4.0.1-7, 4:4.0.2-9 |
| Ubuntu:16.04:LTS | redis | *, *, 2:3.0.5-2 |
Timeline
- Jul 11, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 28, 2023 EPSS Score
- Apr 30, 2023 EPSS Score
- Aug 20, 2023 EPSS Score
- Jan 7, 2024 EPSS Score
- Apr 30, 2024 EPSS Score
- Jul 4, 2024 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-10192 third-party-advisory
- https://github.com/antirez/redis/issues/6215 third-party-advisory
- https://github.com/antirez/redis/commit/e216ceaf0e099536fe3658a29dcb725d812364e0 third-party-advisory
- https://github.com/antirez/redis/commit/9f13b2bd4967334b1701c6eccdf53760cb13f79e third-party-advisory
- https://github.com/antirez/redis/commit/ef1833b3f9d02261617b757fd6ebe0ec3f1be507 third-party-advisory
- https://github.com/antirez/redis/commit/7f79849caa006f0d760b6c7e17f7796e3be92b4f third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10192 third-party-advisory
- https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES third-party-advisory
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES third-party-advisory
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES third-party-advisory
- https://ubuntu.com/security/notices/USN-4061-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-10192 third-party-advisory