PT-2020-22783 · Redis+3 · Hiredis+3
Published
2020-01-05
·
Updated
2020-07-10
·
CVE-2019-XXXX
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
hiredis versions 0.14.0 and earlier
MediaWiki versions prior to 1.31.8
mutt (affected versions not specified)
cyrus-sasl (affected versions not specified)
Description:
The issue involves several software packages, including hiredis, MediaWiki, mutt, and cyrus-sasl. In hiredis, there is a NULL pointer dereference due to unchecked malloc return values in async.c and dict.c. For MediaWiki, private wikis may have had their files cached publicly due to mishandled Cache-Control and Vary headers. The mutt package has an issue with the invalid format of an RFC parameter passed to the atoi() function, potentially leading to unexpected behavior. Lastly, cyrus-sasl has an out-of-bounds write vulnerability in the sasl add string() function, which can cause denial-of-service conditions.
Recommendations:
For hiredis versions 0.14.0 and earlier, update to a version later than 0.14.0 to resolve the NULL pointer dereference issue.
For MediaWiki versions prior to 1.31.8, update to version 1.31.8 or later to fix the issue with mishandled Cache-Control and Vary headers.
For mutt, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For cyrus-sasl, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mediawiki
Cyrus-Sasl
Hiredis
Mutt