Vulnerability · Published Jan 8, 2025 · Assigned by GitHub_M

CVE-2024-51480RedisTimeSeries Integer Overflow Remote Code Execution Vulnerability

High 7.0

In plain English

A high-severity heap buffer overflow in RedisTimeSeries from RedisTimeSeries. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.2%top 89.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by an authenticated user, using specially crafted command arguments may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This vulnerability is fixed in 1.6.20, 1.8.15, 1.10.15, and 1.12.3.

Affected products (as reported)

Vendor	Product	Versions
RedisTimeSeries	RedisTimeSeries	>= 1.0.0, < 1.6.20>= 1.8.0, < 1.8.15>= 1.10.0, < 1.10.15>= 1.12.0, < 1.12.3

Weakness: CWE-122, CWE-190 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/RedisTimeSeries/RedisTimeSeries/security/advisories/GHSA-73x6-fqww-x8rg x_refsource_CONFIRM