Уязвимость CVE-2019-10192: Информация

Описание

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

Важность: HIGH (7,2) Вектор: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-10192
Опубликовано: 11 июля 2019 г.
Изменено: 28 октября 2021 г.
Идентификатор типа ошибки: CWE-787

Исправленные пакеты

Имя пакета
Ветка
Исправлено в версии
Версия в репозитории
Errata ID
№ Задания
Состояние
redissisyphus5.0.4-alt17.2.4-alt1.1ALT-PU-2019-1790-1229175Исправлено
redisp105.0.4-alt16.2.14-alt1ALT-PU-2019-1790-1229175Исправлено
redisp95.0.4-alt16.2.4-alt1ALT-PU-2019-1790-1229175Исправлено
redisp83.0.7-alt23.0.7-alt2ALT-PU-2019-3195-1241717Исправлено
redisc10f15.0.4-alt16.2.13-alt1ALT-PU-2019-1790-1229175Исправлено
redisc9f25.0.4-alt16.2.13-alt1ALT-PU-2019-1790-1229175Исправлено

Ссылки на рекомендации, решения и инструменты

Ссылка
Ресурс
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10192
  • Issue Tracking
  • Third Party Advisory
https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
  • Release Notes
  • Vendor Advisory
https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
  • Release Notes
  • Vendor Advisory
https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES
  • Release Notes
  • Vendor Advisory
DSA-4480
  • Third Party Advisory
20190712 [SECURITY] [DSA 4480-1] redis security update
  • Mailing List
  • Third Party Advisory
USN-4061-1
  • Third Party Advisory
109290
  • Third Party Advisory
  • VDB Entry
RHSA-2019:1819
  • Third Party Advisory
RHSA-2019:1860
  • Third Party Advisory
RHSA-2019:2002
  • Third Party Advisory
GLSA-201908-04
  • Third Party Advisory
RHSA-2019:2508
  • Third Party Advisory
RHSA-2019:2506
  • Third Party Advisory
RHSA-2019:2621
  • Third Party Advisory
RHSA-2019:2630
  • Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
  • Patch
  • Third Party Advisory

    1. Конфигурация 1

      cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*
      Start including
      5.0
      End excliding
      5.0.4
      cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*
      Start including
      3.0.0
      End excliding
      3.2.13
      cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*
      Start including
      4.0.0
      End excliding
      4.0.14

      Конфигурация 2

      cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
      cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
      cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
      cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
      cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

      Конфигурация 3

      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

      Конфигурация 4

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

      Конфигурация 5

      cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
      cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Версия: v24.5.0
Наверх