TimeSeries up to 1.6.19/1.8.14/1.10.14/1.12.2 on Redis TS.QUERYINDEX/TS.MGET/TS.MRAGE/TS.MREVRANGE heap-based overflow

Summaryinfo

A vulnerability was found in TimeSeries up to 1.6.19/1.8.14/1.10.14/1.12.2 on Redis. It has been declared as critical. This issue affects the function TS.QUERYINDEX/TS.MGET/TS.MRAGE/TS.MREVRANGE. Executing a manipulation can lead to heap-based overflow. This vulnerability is registered as CVE-2024-51480. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in TimeSeries up to 1.6.19/1.8.14/1.10.14/1.12.2 on Redis. This vulnerability affects the function TS.QUERYINDEX/TS.MGET/TS.MRAGE/TS.MREVRANGE. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by an authenticated user, using specially crafted command arguments may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This vulnerability is fixed in 1.6.20, 1.8.15, 1.10.15, and 1.12.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-51480 since 10/28/2024. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.6.20, 1.8.15, 1.10.15 or 1.12.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• TimeSeries

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17
• 1.6.18
• 1.6.19
• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 1.8.8
• 1.8.9
• 1.8.10
• 1.8.11
• 1.8.12
• 1.8.13
• 1.8.14
• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4
• 1.10.5
• 1.10.6
• 1.10.7
• 1.10.8
• 1.10.9
• 1.10.10
• 1.10.11
• 1.10.12
• 1.10.13
• 1.10.14
• 1.12.0
• 1.12.1
• 1.12.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion