This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-10192 →

DEBIAN-CVE-2019-10192

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5....

Original description

The description as published by the source.

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.4-1"}]}]

Debian:13 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.4-1"}]}]

Debian:14 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.4-1"}]}]

References

advisory security-tracker.debian.org