CVE-2021-32765

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-32765
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32765.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32765
Aliases
  • GHSA-hfm9-39pp-55p2
Related
Published
2021-10-04T21:15:12Z
Modified
2024-08-01T07:57:02.988124Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the maxelements context option to a value small enough that no overflow is possible.

References

Affected packages

Debian:11 / hiredis

Package

Name
hiredis
Purl
pkg:deb/debian/hiredis?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.14.1-1
0.14.1-2
0.14.1-3
0.14.1-4

1.*

1.0.0-1
1.0.0-2
1.0.0-3
1.0.2-1
1.0.2-2
1.1.0~rc1-1
1.2.0-1
1.2.0-2
1.2.0-3
1.2.0-4
1.2.0-5
1.2.0-6

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:12 / hiredis

Package

Name
hiredis
Purl
pkg:deb/debian/hiredis?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.14.1-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:13 / hiredis

Package

Name
hiredis
Purl
pkg:deb/debian/hiredis?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.14.1-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Git / github.com/redis/hiredis

Affected ranges

Type
GIT
Repo
https://github.com/redis/hiredis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
76a7b10005c70babee357a7d0f2becf28ec7ed1e

Affected versions

v0.*

v0.0.1
v0.10.0
v0.10.1
v0.11.0
v0.12.0
v0.12.1
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.14.0
v0.9.0
v0.9.1
v0.9.2

v1.*

v1.0.0
v1.0.0-rc1