Bug 26255 - hiredis new security issue CVE-2020-7105
Summary: hiredis new security issue CVE-2020-7105
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2020-02-25 14:40 CET by David Walser
Modified: 2020-02-29 14:43 CET (History)
5 users (show)

See Also:
Source RPM: hiredis-0.13.3-5.mga8.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2020-02-25 14:40:39 CET 
Fedora has issued an advisory on February 24:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZKOTCIYFEWJJILUGL4JQ3CJAM3TWYZ2A/

Mageia 7 is also affected.
David Walser 2020-02-25 14:40:47 CET

Whiteboard: (none) => MGA7TOO

Comment 1 Lewis Smith 2020-02-25 19:51:38 CET 
No evident maintainer, so assigning this globally; CC'ing DavidG who has recently touched it.

Assignee: bugsquad => pkg-bugs
CC: (none) => geiger.david68210

Comment 2 David GEIGER 2020-02-25 20:53:00 CET 
Done for both Cauldron and mga7!
Comment 3 David Walser 2020-02-25 21:46:12 CET 
Advisory:
========================

Updated hiredis packages fix security vulnerability:

async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL
pointer dereference because malloc return values are unchecked (CVE-2020-7105).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7105
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZKOTCIYFEWJJILUGL4JQ3CJAM3TWYZ2A/
========================

Updated packages in core/updates_testing:
========================
libhiredis0.13-0.13.3-4.1.mga7
libhiredis-devel-0.13.3-4.1.mga7

from hiredis-0.13.3-4.1.mga7.src.rpm

Whiteboard: MGA7TOO => (none)
Assignee: pkg-bugs => qa-bugs
Version: Cauldron => 7

Comment 4 Len Lawrence 2020-02-26 21:04:00 CET 
mga7, x86_64

Before updating installed tellico and created a book collection with two entries.

Updated the two packages and ran tellico under strace.

It picked up the book collection OK.  Displayed the entries then started a music collection.

$ strace -o tellico.trace tellico
$ grep hiredis tellico.trace
openat(AT_FDCWD, "/lib64/libhiredis.so.0.13", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib64/libhiredis.so.0.13", O_RDONLY) = 3
openat(AT_FDCWD, "/usr/lib64/libhiredis.so.0.13", O_RDONLY) = 23

Opened the music collection and printed out one of the entries.
Tellico works and libhiredis0.13 by inference.

CC: (none) => tarazed25
Whiteboard: (none) => MGA7-64-OK

Comment 5 Thomas Andrews 2020-02-28 01:11:08 CET 
Validating. Advisory in Comment 3.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2020-02-29 13:45:50 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 6 Mageia Robot 2020-02-29 14:43:52 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0109.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.