CVE-2019-10192 Memory corruption in redis

High 7.2 Published 11 Jul 2019 Updated 4 Aug 2024

Heap buffer overflow in Redis hyperloglog allows attackers to write beyond buffer bounds, potentially causing crashes or code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10192?

CVE-2019-10192 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 11 Jul 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2019-10192?

It affects 10 products.

Linux distribution packages (10)

`redis` Red Hat:openstack-optools:9::el7	All versions	`0:3.0.6-5.el7ost`
`redis-debuginfo` Red Hat:openstack-optools:9::el7	All versions	`0:3.0.6-5.el7ost`
`redis` Red Hat:openstack:10::el7	All versions	`0:3.0.6-5.el7ost`
`redis-debuginfo` Red Hat:openstack:10::el7	All versions	`0:3.0.6-5.el7ost`
`redis` Red Hat:openstack:13::el7	All versions	`0:3.2.8-4.el7ost`
`redis-debuginfo` Red Hat:openstack:13::el7	All versions	`0:3.2.8-4.el7ost`
`redis` Red Hat:openstack:14::el7	All versions	`0:3.2.8-4.el7ost`
`redis-debuginfo` Red Hat:openstack:14::el7	All versions	`0:3.2.8-4.el7ost`
`redis` Red Hat:openstack:9::el7	All versions	`0:3.0.6-5.el7ost`
`redis-debuginfo` Red Hat:openstack:9::el7	All versions	`0:3.0.6-5.el7ost`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Oracle Communications Operations Monitor, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server Aus and 4 more.

How do I fix CVE-2019-10192?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-10192 being exploited?

There is no known exploitation of CVE-2019-10192 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-10192, CLEANSTART-2026-XD35683, DEBIAN-CVE-2019-10192, DLA-1850-1, GHSA-pgcv-crqq-f8x5, RHSA-2019:2506 and 6 more.