A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1819 advisory.

  - redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)

  - redis: Stack buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10193)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:2002 advisory.

  - A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before     3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE     command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond     the end of a heap-allocated buffer. (CVE-2019-10192)

  - A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x     before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE     command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of     a stack-allocated buffer. (CVE-2019-10193)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the redis package has been released.

From Red Hat Security Advisory 2019:2002 :

An update for the redis:5 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es) :

* redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)

* redis: Stack buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for the redis:5 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es) :

* redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)

* redis: Stack buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote host is affected by the vulnerability described in GLSA-201908-04 (Redis: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Redis. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

It was discovered that Redis incorrectly handled the hyperloglog data structure. An attacker could use this issue to cause Redis to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in the HyperLogLog implementation of Redis, a persistent key-value database, which could result in denial of service or potentially the execution of arbitrary code.

ID	Name	Product	Family	Severity
194146	RHEL 7 : rh-redis5-redis (RHSA-2019:1819)	Nessus	Red Hat Local Security Checks	high
184549	Rocky Linux 8 : redis:5 (RLSA-2019:2002)	Nessus	Rocky Linux Local Security Checks	high
128737	Photon OS 2.0: Redis PHSA-2019-2.0-0173	Nessus	PhotonOS Local Security Checks	high
128727	Photon OS 1.0: Redis PHSA-2019-1.0-0249	Nessus	PhotonOS Local Security Checks	high
128159	Photon OS 3.0: Redis PHSA-2019-3.0-0024	Nessus	PhotonOS Local Security Checks	high
127977	Oracle Linux 8 : redis:5 (ELSA-2019-2002)	Nessus	Oracle Linux Local Security Checks	high
127644	RHEL 8 : redis:5 (RHSA-2019:2002)	Nessus	Red Hat Local Security Checks	high
127562	GLSA-201908-04 : Redis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
126773	Ubuntu 16.04 LTS / 18.04 LTS : Redis vulnerabilities (USN-4061-1)	Nessus	Ubuntu Local Security Checks	high
126655	Debian DSA-4480-1 : redis - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-10193

high

Tenable Plugins

high

high

high

high

high

high

high

critical

high

high