async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.

An update of the redis package has been released.

Fix for CVE-2020-7105 hiredis: NULL pointer dereference in async.c and dict.c

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there were a large number of NULL pointer dereferences due to unchecked return values from malloc and friends in hiredis, a minimalistic C client library.

For Debian 8 'Jessie', these issue have been fixed in hiredis version 0.11.0-4+deb8u1.

We recommend that you upgrade your hiredis packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
140122	Photon OS 2.0: Redis PHSA-2020-2.0-0278	Nessus	PhotonOS Local Security Checks	high
133892	Fedora 30 : hiredis (2020-f6cc7883b8)	Nessus	Fedora Local Security Checks	high
133886	Fedora 31 : hiredis (2020-53a54ef986)	Nessus	Fedora Local Security Checks	high
133321	Debian DLA-2083-1 : hiredis security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-7105

high

Tenable Plugins

high

high

high

high