In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1576 advisory.

  - In memcached before 1.5.14, a NULL pointer dereference was found in the lru mode and lru temp_ttl     commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command     in memcached.c. (CVE-2019-11596)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1576 advisory.

  - memcached: null-pointer dereference in lru mode and lru temp_ttl causing denial of service     (CVE-2019-11596)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5583 advisory.

  - memcached: null-pointer dereference in lru mode and lru temp_ttl causing denial of service     (CVE-2019-11596)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.01, has memcached packages installed that are affected by a vulnerability:

  - In memcached before 1.5.14, a NULL pointer dereference     was found in the lru mode and lru temp_ttl commands.
    This causes a denial of service when parsing crafted lru     command messages in process_lru_command in memcached.c.
    (CVE-2019-11596)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for memcached fixes the following issues :

Security issue fixed :

CVE-2019-11596: Fixed a NULL pointer dereference in process_lru_command (bsc#1133817).

CVE-2019-15026: Fixed a stack-based buffer over-read (bsc#1149110).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for memcached fixes the following issues :

Security issue fixed :

  - CVE-2019-11596: Fixed a NULL pointer dereference in     process_lru_command (bsc#1133817).

  - CVE-2019-15026: Fixed a stack-based buffer over-read     (bsc#1149110).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1576 advisory.

  - memcached: null-pointer dereference in lru mode and lru temp_ttl causing denial of service     (CVE-2019-11596)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the memcached package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In memcached before 1.5.14, a NULL pointer dereference     was found in the 'lru mode' and 'lru temp_ttl'     commands. This causes a denial of service when parsing     crafted lru command messages in process_lru_command in     memcached.c.(CVE-2019-11596)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-11596

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-11596

----

Update to the lastest upstream release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Memcached incorrectly handled certain lru command messages. A remote attacker could possibly use this issue to cause Memcached to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180947	Oracle Linux 8 : memcached (ELSA-2020-1576)	Nessus	Oracle Linux Local Security Checks	high
145982	CentOS 8 : memcached (CESA-2020:1576)	Nessus	CentOS Local Security Checks	high
144398	RHEL 7 : memcached (RHSA-2020:5583)	Nessus	Red Hat Local Security Checks	high
138778	NewStart CGSL MAIN 6.01 : memcached Vulnerability (NS-SA-2020-0033)	Nessus	NewStart CGSL Local Security Checks	high
137537	SUSE SLES15 Security Update : memcached (SUSE-SU-2020:1381-1)	Nessus	SuSE Local Security Checks	high
136962	openSUSE Security Update : memcached (openSUSE-2020-721)	Nessus	SuSE Local Security Checks	high
136045	RHEL 8 : memcached (RHSA-2020:1576)	Nessus	Red Hat Local Security Checks	high
135167	SUSE SLES12 Security Update : memcached (SUSE-SU-2020:0843-1)	Nessus	SuSE Local Security Checks	high
131495	EulerOS Virtualization for ARM 64 3.0.3.0 : memcached (EulerOS-SA-2019-2330)	Nessus	Huawei Local Security Checks	high
125184	Fedora 29 : memcached (2019-df4c0ba2db)	Nessus	Fedora Local Security Checks	high
125178	Fedora 30 : memcached (2019-2bd8e73268)	Nessus	Fedora Local Security Checks	high
124561	Ubuntu 18.04 LTS : Memcached vulnerability (USN-3963-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2019-11596

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high