PT-2024-40361 · Surrealdb · Surrealdb

Published 2024-11-22 · Updated 2024-11-22

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.1.0

Description The issue arises when using an ORDER BY clause with the rand() function for sorting table records, which can cause a panic due to a comparison function that does not implement total order. This can lead to a denial of service if a client authorized to run queries in a SurrealDB server exploits this weakness. The estimated number of potentially affected devices is not specified.

Recommendations For SurrealDB versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider limiting the ability of untrusted clients to run arbitrary SurrealQL queries. Additionally, ensure that the SurrealDB process is configured to automatically restart after a crash to minimize the impact of the denial of service.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

GHSA-M52V-24P8-654F

Affected Products

Surrealdb

References · 7

• https://osv.dev/vulnerability/GHSA-m52v-24p8-654f · Vendor Advisory
• https://github.com/surrealdb/surrealdb · Note
• https://github.com/surrealdb/surrealdb/pull/4805 · Note
• https://github.com/surrealdb/surrealdb/pull/4989 · Note
• https://github.com/surrealdb/surrealdb/pull/4906 · Note
• https://github.com/surrealdb/surrealdb/issues/4969 · Note
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m52v-24p8-654f · Note