CVE-2020-7105

NameCVE-2020-7105
Descriptionasync.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2083-1
Debian Bugs949995

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
hiredis (PTS)jessie, jessie (lts)0.11.0-4+deb8u2fixed
stretch0.13.3-2vulnerable
stretch (security), stretch (lts)0.13.3-1+deb9u1vulnerable
buster0.14.0-3vulnerable
bullseye0.14.1-1fixed
bookworm0.14.1-3fixed
sid, trixie1.2.0-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
hiredissourcewheezy(unfixed)end-of-life
hiredissourcejessie0.11.0-4+deb8u1DLA-2083-1
hiredissource(unstable)0.14.0-5949995

Notes

[buster] - hiredis <no-dsa> (Minor issue)
[stretch] - hiredis <no-dsa> (Minor issue)
https://github.com/redis/hiredis/pull/754
https://github.com/redis/hiredis/pull/756

Search for package or bug name: Reporting problems