APP: Redis CVE-2019-10192 Heap Buffer Overflow

This signature detects attempts to exploit a known vulnerability in the Redis application. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user.

Extended Description

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

Affected Products

Redhat enterprise_linux_server_tus

References

BugTraq: 109290

CVE: CVE-2023-36824

URL: https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3

Short Name

APP:CVE-2019-10192-BO

Severity

Major

Recommended

True

Recommended Action

Drop

APP: Redis CVE-2019-10192 Heap Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?