CVE-2019-10193

A stack buffer overflow vulnerability was found in the Redis HyperLogLog data structure. By corrupting a HyperLogLog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.

The following product versions are not affected because they do not ship the vulnerable code:

• Red Hat OpenStack Platform, all versions
• Red Hat Ceph Storage 3, which only ships the client-side part of Redis in its packaged Grafana.
• Red Hat Gluster Storage 3, which only ships the client-side part of Redis in its packaged Grafana and Heketi.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.