Skip to content
OpenAdvisories
High · 8.8 CVE-2021-32765 EUVD-2021-19533

Integer Overflow to Buffer Overflow in Hiredis

Published Oct 4, 2021 · Updated Aug 3, 2024 · Assigned by GitHub_M

Description

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible.

Affected products

VendorProductAffectedFixed
redis hiredis < 1.0.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 hiredis 0.14.1-2 —
Debian 13 hiredis 0.14.1-2 —
Debian 12 hiredis 0.14.1-2 —
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS hiredis No fix yet —
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP3 hiredis 0.13.3-bp153.2.3.1 openSUSE-SU-2021:1536-1
SUSE Package Hub 15 SP2 hiredis 0.13.3-bp152.4.3.1 openSUSE-SU-2021:1550-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed hiredis 1.0.2-1.1 openSUSE-SU-2024:11561-1
openSUSE Leap 15.3 hiredis 0.13.3-bp153.2.3.1 openSUSE-SU-2021:1536-1
openSUSE Leap 15.2 hiredis 0.13.3-bp153.2.3.1 openSUSE-SU-2021:1536-1

Advisories 3

References