Bug 2013499 (CVE-2021-32765)
Summary: | CVE-2021-32765 hiredis: an integer overflow may occur if provided maliciously crafted or corrupted RESP mult-bulk protocol data | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
Component: | vulnerability | Assignee: | Nobody <nobody> |
Status: | NEW --- | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | bcoca, bdettelb, davidn, gblomqui, jcammara, jhardy, jobarker, kevin, mabashia, nathans, osapryki, relrod, rpetrell, smcdonal, tkuratom |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | hiredis 1.0.1 | Doc Type: | If docs needed, set a value |
Doc Text: |
An integer overflow flaw when parsing array replies was found in hiredis, which leads to a buffer overflow and subsequent code execution. This flaw allows a remote attacker to execute arbitrary commands and craft a malicious payload to execute commands on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | Type: | --- | |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 2013501, 2013500 | ||
Bug Blocks: | 2013502 |
Description
Marian Rehak
2021-10-13 04:45:39 UTC
Created hiredis tracking bugs for this issue: Affects: fedora-all [bug 2013500] Created hiredis tracking bugs for this issue: Affects: epel-all [bug 2013501] |