{"id":"CVE-2020-7105","aliases":["BELL-CVE-2020-7105","DEBIAN-CVE-2020-7105","DLA-2083-1","EUVD-2020-28239","GHSA-cjp9-9h2g-g3x5","MGASA-2020-0109","UBUNTU-CVE-2020-7105","openSUSE-SU-2024:10844-1"],"status":"published","title":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference...","description":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02758,"percentile":0.86371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2020-01-16T03:36:35Z","modified":"2026-10-26T12:02:48Z","fixes":[{"ecosystem":"Debian:12","package":"hiredis","fixed_in":["0.14.0-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"hiredis","fixed_in":["0.14.0-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"hiredis","fixed_in":["0.14.0-5"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"hiredis","fixed_in":["0.11.0-4+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"hiredis","fixed_in":["0.13.3-4.1.mga7"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"hiredis","fixed_in":["1.0.0-2.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"hiredis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"hiredis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"hiredis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-5"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"hiredis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-4+deb8u1"}]}],"versions":["0.11.0-4"]},{"source":"osv","ecosystem":"Mageia:7","package":"hiredis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.3-4.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"hiredis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.1-2","0.13.3-1","0.13.3-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"hiredis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.3-2","0.13.3-2.1","0.13.3-2.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hiredis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2.6"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redislabs","product":"hiredis"}],"references":[{"url":"https://github.com/redis/hiredis/issues/747","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76ZDGWBV3YEEQ2YC65ZJEQLKQFVFBZHX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKOTCIYFEWJJILUGL4JQ3CJAM3TWYZ2A/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7105"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/76ZDGWBV3YEEQ2YC65ZJEQLKQFVFBZHX/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKOTCIYFEWJJILUGL4JQ3CJAM3TWYZ2A/"},{"url":"https://github.com/advisories/GHSA-cjp9-9h2g-g3x5"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-7105","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7105","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0109.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26255","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZKOTCIYFEWJJILUGL4JQ3CJAM3TWYZ2A/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-7105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7105","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7105","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-7105","description":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.","status":"published","published":"2020-01-16T03:36:35Z","modified":"2024-08-04T09:18:03.11Z","updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2020-28239","description":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.","status":"published","published":"2020-01-16T03:36:35Z","modified":"2024-08-04T09:18:03Z","updated_at":"2026-11-03T03:08:01.029528Z"}],"ghsa":[{"id":"GHSA-cjp9-9h2g-g3x5","title":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference...","description":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.","status":"published","published":"2022-05-24T17:06:49Z","modified":"2023-02-08T05:07:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:53:59.604858Z"}],"nvd":[{"id":"CVE-2020-7105","description":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.","status":"published","published":"2020-01-16T04:15:11.617Z","modified":"2026-06-17T03:24:19.76Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:05:52.385274Z"}],"osv":[{"id":"BELL-CVE-2020-7105","title":"CVE-2020-7105 does not affect BellSoft software","status":"withdrawn","published":"2020-01-16T04:15:00Z","modified":"2026-01-26T09:47:59.996942Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-7105","description":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.","status":"published","published":"2020-01-16T04:15:11.617Z","modified":"2026-10-20T10:54:24.455707486Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-7105","description":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.","status":"published","published":"2020-01-16T04:15:11.617Z","modified":"2026-10-26T12:02:48.847253537Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"UBUNTU-CVE-2020-7105","description":"async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.","status":"published","published":"2020-01-16T04:15:00Z","modified":"2026-04-22T12:43:00.76285Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"DLA-2083-1","title":"hiredis - security update","status":"published","published":"2020-01-29T00:00:00Z","modified":"2026-03-09T01:23:28.676878Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0109","title":"Updated hiredis packages fix security vulnerability","description":"Updated hiredis packages fix security vulnerability:\n\nasync.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a\nNULL pointer dereference because malloc return values are unchecked\n(CVE-2020-7105).\n","status":"published","published":"2020-02-29T13:42:35Z","modified":"2026-04-16T04:43:22.171628285Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:10844-1","title":"hiredis-1.0.0-2.6 on GA media","description":"These are all security issues fixed in the hiredis-1.0.0-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:20.730677Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}