VYPR
High severity7.2NVD Advisory· Published Jul 11, 2019· Updated Jun 17, 2026

CVE-2019-10192

CVE-2019-10192

Description

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

23
  • cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:*
  • Red Hat/Openstack4 versions
    cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
  • Redis/Redis2 versions
    cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*range: >=3.0.0,<3.2.13
    • (no CPE)range: <3.2.13, <4.0.14, <5.0.4
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*+ 2 more
    • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
  • Debian/linux2 versions
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
  • Redis Labs/redisv5
    Range: 3.x before 3.2.13

Patches

Vulnerability mechanics

References

17

News mentions

0

No linked articles in our index yet.