git: 288f8b2b688b - main - security/vuxml: document vulnerability in databases/hiredis

From: Jimmy Olgeni <olgeni_at_FreeBSD.org>
Date: Fri, 29 Apr 2022 19:36:31 UTC 
The branch main has been updated by olgeni:

URL: https://cgit.FreeBSD.org/ports/commit/?id=288f8b2b688b6b7fcd9931bf43ae414c341154dc

commit 288f8b2b688b6b7fcd9931bf43ae414c341154dc
Author:     Jimmy Olgeni <olgeni@FreeBSD.org>
AuthorDate: 2022-04-29 14:11:58 +0000
Commit:     Jimmy Olgeni <olgeni@FreeBSD.org>
CommitDate: 2022-04-29 19:35:59 +0000

    security/vuxml: document vulnerability in databases/hiredis
    
    PR:             263648
    Reported by:    Sascha Biberhofer
---
 security/vuxml/vuln-2022.xml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml
index ce7abd4513d9..6fc491f94bcf 100644
--- a/security/vuxml/vuln-2022.xml
+++ b/security/vuxml/vuln-2022.xml
@@ -1,3 +1,33 @@
+  <vuln vid="2220827b-c732-11ec-b272-901b0e934d69">
+    <topic>hiredis -- integer/buffer overflow</topic>
+    <affects>
+      <package>
+	<name>hiredis</name>
+	<range><lt>1.0.1</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>hiredis maintainers report:</p>
+	<blockquote cite="https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2">
+	  <p>
+	    Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data.
+
+	    When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2021-32765</cvename>
+      <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32765</url>
+      <url>https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2</url>
+    </references>
+    <dates>
+      <discovery>2021-10-04</discovery>
+      <entry>2022-04-29</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="92a4d881-c6cf-11ec-a06f-d4c9ef517024">
     <topic>cURL -- Multiple vulnerabilities</topic>
     <affects>