Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix the integer overflow #684

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

Crispy-fried-chicken
Copy link

fix the vulnerability mentioned in #682

@slact
Copy link
Owner

slact commented Feb 27, 2024

...are you serious? Okay, then.

## [1.0.2](https://github.com/redis/hiredis/tree/v1.0.2) - (2021-10-07)
Announcing Hiredis v1.0.2, which fixes CVE-2021-32765 but returns the SONAME to the correct value of `1.0.0`.

There is nothing to fix.

@slact slact closed this Feb 27, 2024
@Crispy-fried-chicken
Copy link
Author

but you can see in the newest version of hiredis, the https://github.com/redis/hiredis/blob/398e16e7cc20545a19f2af2293cc6f04310e6b7a/sds.c#L93C1-L93C78 is added which is similiar to the fix of the CVE-2021-21309, maybe you can fix it? Cause the vulnerability still exist.

@slact
Copy link
Owner

slact commented Mar 6, 2024

Okay okay I guess you're serious. Fine, even though there's no way to exploit this without letting Nginx accept >4Gb messages (instant DoS), which is way outside the realm of sanity, I will upgrade hiredis to the latest version.

@slact slact reopened this Mar 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants