CVE-2020-7105

NameCVE-2020-7105
Descriptionasync.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2083-1
NVD severitymedium
Debian Bugs949995

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
hiredis (PTS)stretch0.13.3-2vulnerable
buster0.14.0-3vulnerable
bullseye, sid0.14.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
hiredissourcejessie0.11.0-4+deb8u1DLA-2083-1
hiredissource(unstable)0.14.0-5949995

Notes

[buster] - hiredis <no-dsa> (Minor issue)
[stretch] - hiredis <no-dsa> (Minor issue)
https://github.com/redis/hiredis/pull/754
https://github.com/redis/hiredis/pull/756

Search for package or bug name: Reporting problems