CVE-2024-51480

Description

RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by an authenticated user, using specially crafted command arguments may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This vulnerability is fixed in 1.6.20, 1.8.15, 1.10.15, and 1.12.3.

Reserved 2024-10-28 | Published 2025-01-08 | Updated 2025-01-08 | Assigner GitHub_M

Problem types

CWE-122: Heap-based Buffer Overflow

CWE-190: Integer Overflow or Wraparound

Product status

>= 1.0.0, < 1.6.20
affected

>= 1.8.0, < 1.8.15
affected

>= 1.10.0, < 1.10.15
affected

>= 1.12.0, < 1.12.3
affected

References

github.com/...Series/security/advisories/GHSA-73x6-fqww-x8rg

cve.org (CVE-2024-51480)

nvd.nist.gov (CVE-2024-51480)

Download JSON