CVE-2019-11596 Null dereference in n/a

High 7.5 Published 29 Apr 2019 Updated 4 Aug 2024

A NULL pointer dereference in memcached allows remote attackers to cause a denial of service via crafted LRU command messages.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-11596?

CVE-2019-11596 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 29 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.

Weakness: CWE-476

Which versions are affected by CVE-2019-11596?

It affects 2 products.

Linux distribution packages (5)

`memcached` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.5.9-3.el8`
`memcached-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.5.9-3.el8`
`memcached-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.5.9-3.el8`
`memcached` Red Hat:openstack:13::el7	All versions	`0:1.4.39-3.el7ost`
`memcached-debuginfo` Red Hat:openstack:13::el7	All versions	`0:1.4.39-3.el7ost`

Products include Canonical Ubuntu Linux, Memcached Memcached.

How do I fix CVE-2019-11596?

Upgrade to a fixed version.

Is CVE-2019-11596 being exploited?

There is no known exploitation of CVE-2019-11596 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-11596, GHSA-p785-ww3c-xg46, MGASA-2019-0232, RHSA-2020:1576, RHSA-2020:5583, UBUNTU-CVE-2019-11596 and 1 more.