Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
91
security advisoryGentooremote code executionGentoo: GLSA-202210-32 Normal: Hiredis Code Execution Issue
An integer overflow has been found in hiredis which could result in arbitrary code execution.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202210-32 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: hiredis, hiredis-py: Multiple Vulnerabilities Date: October 31, 2022 Bugs: #873079, #816318 ID: 202210-32 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= An integer overflow has been found in hiredis which could result in arbitrary code execution. Background ========= hiredis is a minimalistic C client library for the Redis database. hiredis-py is a Python extension that wraps hiredis. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/hiredis < 1.0.1 > = 1.0.1 2 dev-python/hiredis < 2.0.0 > = 2.0.0 Description ========== Hiredis is vulnerable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Impact ===== Malicious Redis commands could result in remote code execution. Workaround ========= There is no known workaround at this time. Resolution ========= All hiredis users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/hiredis-1.0.1" All hiredis-py users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-python/hiredis-2.0.0" References ========= [ 1 ] CVE-2021-32765 https://nvd.nist.gov/vuln/detail/CVE-2021-32765 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202210-32 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Oct 30, 2022
Gentoo
89
security advisoryFedorainteger overflowFedora 35: 2022-ec83686a30 Critical: Hiredis Integer Overflow Fix
Fix for CVE-2021-32765. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-ec83686a30 2022-01-30 01:32:45.469266 --------------------------------------------------------------------------------Name : hiredis Product : Fedora 35 Version : 0.13.3 Release : 17.fc35 URL : https://github.com/redis/hiredis Summary : Minimalistic C client library for Redis Description : Hiredis is a minimalistic C client library for the Redis database. --------------------------------------------------------------------------------Update Information: Fix for CVE-2021-32765 --------------------------------------------------------------------------------ChangeLog: * Wed Nov 24 2021 Paul Ezvan - 0.13.3-17 - Add patch for CVE-2021-32765 --------------------------------------------------------------------------------References: [ 1 ] Bug #2013500 - CVE-2021-32765 hiredis: an integer overflow may occur if provided maliciously crafted or corrupted RESP mult-bulk protocol data [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2013500 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-ec83686a30' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 29, 2022
•Critical
Fedora
203
security advisoryupdatecriticalMageia 8: 2021-0562 Critical: Hiredis Integer Overflow Threat
Updated hiredis packages fix security vulnerability: It was discovered that there was an integer-overflow vulnerability in hiredis, a C client library for communicating with Redis databases. This occurred within the handling and parsing of 'multi-bulk' replies . MGASA-2021-0562 - Updated hiredis packages fix security vulnerability Publication date: 19 Dec 2021 URL: https://advisories.mageia.org/MGASA-2021-0562.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-32765 Updated hiredis packages fix security vulnerability: It was discovered that there was an integer-overflow vulnerability in hiredis, a C client library for communicating with Redis databases. This occurred within the handling and parsing of 'multi-bulk' replies (CVE-2021-32765). References: - https://bugs.mageia.org/show_bug.cgi?id=29549 - https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2 - https://lists.debian.org/debian-lts-announce/2021/10/msg00007.html - https://www.cve.org/CVERecord?id=CVE-2021-32765 SRPMS: - 8/core/hiredis-0.13.3-6.1.mga8 . Recent updates for the hiredis packages rectify a significant integer overflow issue present in Mageia 8 that impacts Redis interactions.. Hiredis Update, Mageia Security, Redis Integer Overflow, Security Patch. . Severity: Critical. LinuxSecurity.com Team
Dec 19, 2021
•Critical
Mageia
197
security advisorycriticalDebianDebian 9: DLA-2783-1 Critical: Hiredis Integer Overflow Advisory
It was discovered that there was an integer-overflow vulnerability in hiredis, a C client library for communicating with Redis databases. This occurred within the handling and parsing of 'multi-bulk' replies. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2783-1
Oct 12, 2021
•Critical
Debian LTS
203
security advisoryNULL pointermemory managementMageia: 2020-0109 Moderate: Hiredis NULL Pointer Dereference
Updated hiredis packages fix security vulnerability: async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked (CVE-2020-7105). . MGASA-2020-0109 - Updated hiredis packages fix security vulnerability Publication date: 29 Feb 2020 URL: https://advisories.mageia.org/MGASA-2020-0109.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-XXXX Updated hiredis packages fix security vulnerability: async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked (CVE-2020-7105). References: - https://bugs.mageia.org/show_bug.cgi?id=26255 - https://lists.fedoraproject.org/archives/list/
Feb 29, 2020
•Important
Mageia
89
security advisoryfedorabug fixFedora 31: FEDORA-2020-53a54ef986 moderate: hiredis NULL Pointer Issue
Fix for CVE-2020-7105 hiredis: NULL pointer dereference in async.c and dict.c. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-53a54ef986 2020-02-24 01:34:08.140990 --------------------------------------------------------------------------------Name : hiredis Product : Fedora 31 Version : 0.13.3 Release : 13.fc31 URL : https://github.com/redis/hiredis Summary : Minimalistic C client library for Redis Description : Hiredis is a minimalistic C client library for the Redis database. --------------------------------------------------------------------------------Update Information: Fix for CVE-2020-7105 hiredis: NULL pointer dereference in async.c and dict.c --------------------------------------------------------------------------------ChangeLog: * Sat Feb 15 2020 Kevin Fenzi - 0.13.3-13 - Apply patch for CVE-2020-7105. Fixes bug #1796474 * Wed Jan 29 2020 Fedora Release Engineering - 0.13.3-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1796475 - CVE-2020-7105 hiredis: NULL pointer dereference in async.c and dict.c in libhiredis.a [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1796475 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-53a54ef986' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announcemailing list --
Feb 23, 2020
Fedora
89
security advisoryfedorabug fixFedora 30 Advisory: 2020-f6cc7883b8 Critical Hiredis Pointer Issue
Fix for CVE-2020-7105 hiredis: NULL pointer dereference in async.c and dict.c. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-f6cc7883b8 2020-02-24 01:12:54.871724 --------------------------------------------------------------------------------Name : hiredis Product : Fedora 30 Version : 0.13.3 Release : 13.fc30 URL : https://github.com/redis/hiredis Summary : Minimalistic C client library for Redis Description : Hiredis is a minimalistic C client library for the Redis database. --------------------------------------------------------------------------------Update Information: Fix for CVE-2020-7105 hiredis: NULL pointer dereference in async.c and dict.c --------------------------------------------------------------------------------ChangeLog: * Sat Feb 15 2020 Kevin Fenzi - 0.13.3-13 - Apply patch for CVE-2020-7105. Fixes bug #1796474 * Wed Jan 29 2020 Fedora Release Engineering - 0.13.3-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Thu Jul 25 2019 Fedora Release Engineering - 0.13.3-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1796475 - CVE-2020-7105 hiredis: NULL pointer dereference in async.c and dict.c in libhiredis.a [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1796475 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-f6cc7883b8' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Feb 23, 2020
•Critical
Fedora
197
security advisorysecurity updateDebianDebian: LTS DLA-2083-1 Moderate: Hiredis NULL Pointer Issue
It was discovered that there were a large number of NULL pointer dereferences due to unchecked return values from malloc and friends in hiredis, a minimalistic C client library. . Package : hiredis Version : 0.11.0-4+deb8u1 CVE ID : CVE-2020-7105 Debian Bug : #949995 It was discovered that there were a large number of NULL pointer dereferences due to unchecked return values from malloc and friends in hiredis, a minimalistic C client library. For Debian 8 "Jessie", these issue have been fixed in hiredis version 0.11.0-4+deb8u1. We recommend that you upgrade your hiredis packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Regards, - -- ,'`. : :' : Chris Lamb `. `'`
Jan 29, 2020
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!