CVE-2021-32765

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the maxelements context option to a value small enough that no overflow is possible.

References

Affected packages

Git / github.com/redis/hiredis

Affected ranges

Type: GIT
Repo: https://github.com/redis/hiredis
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

76a7b10005c70babee357a7d0f2becf28ec7ed1e

Affected versions

v0.*

v0.0.1

v0.10.0

v0.10.1

v0.11.0

v0.12.0

v0.12.1

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.9.0

v0.9.1

v0.9.2

v1.*

v1.0.0

v1.0.0-rc1

Database specific

vanir_signatures

[
    {
        "id": "CVE-2021-32765-28fc1741",
        "source": "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "2960801188689279389740907912361228292",
                "103680156091366763705168315892522468615",
                "313519843436751110082004899014515685551"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "test.c"
        },
        "signature_type": "Line",
        "deprecated": false
    },
    {
        "id": "CVE-2021-32765-39e6d2f9",
        "source": "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e",
        "signature_version": "v1",
        "digest": {
            "length": 581.0,
            "function_hash": "179161735348210698687051920573265359593"
        },
        "target": {
            "function": "createArrayObject",
            "file": "hiredis.c"
        },
        "signature_type": "Function",
        "deprecated": false
    },
    {
        "id": "CVE-2021-32765-40ddc6e5",
        "source": "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "311195162694762926584360255253075821286",
                "34398200280396169294640070927249867179",
                "76188935927609120202871962455023382498",
                "186027357458498207079532665570846242970"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "hiredis.c"
        },
        "signature_type": "Line",
        "deprecated": false
    },
    {
        "id": "CVE-2021-32765-b253503e",
        "source": "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e",
        "signature_version": "v1",
        "digest": {
            "length": 6546.0,
            "function_hash": "160136926384499477379751229509923238067"
        },
        "target": {
            "function": "test_reply_reader",
            "file": "test.c"
        },
        "signature_type": "Function",
        "deprecated": false
    }
]