UBUNTU-CVE-2020-7105: Null Pointer Dereference

Q: What level of access does an attacker need to trigger the issue?

The vector indicates it can be exploited over the network with low attack complexity, without authentication or user interaction.

Q: What is the expected security impact?

The stated impact is denial of service through a NULL pointer dereference. The vector indicates availability impact only, with no reported confidentiality or integrity impact.

Q: How can I determine whether my deployment is affected?

Check the version of hiredis in use. The issue affects hiredis through version 0.14.0 and involves libhiredis.a, specifically async.c and dict.c.

Published Jan 16, 2020

Updated

async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.

Affected Software

2 affected componentsFixes available

ubuntu/hiredis<0.13.3-2ubuntu0.1~esm1

0.13.3-2ubuntu0.1~esm1

ubuntu/hiredis<0.13.3-2.2ubuntu0.1~esm1

0.13.3-2.2ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/hiredis to a version that resolves this vulnerability.
Fixed in 0.13.3-2ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/hiredis to a version that resolves this vulnerability.
Fixed in 0.13.3-2.2ubuntu0.1~esm1

Event History

Jan 16, 2020

CVE Published

via OSV·04:15 AM

Data Sourced

via OSV·04:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access does an attacker need to trigger the issue?

The vector indicates it can be exploited over the network with low attack complexity, without authentication or user interaction.

What is the expected security impact?