CVE-2021-39228: Memory Safety Issue when using patch or merge on state and assign the result back to state
First published: Fri Sep 17 2021(Updated: )
Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to `state`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tremor | >=0.7.2<0.11.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-39228?
CVE-2021-39228 is classified as a memory safety vulnerability in specific versions of Tremor.
How do I fix CVE-2021-39228?
To fix CVE-2021-39228, upgrade Tremor to version 0.11.7 or later.
Which versions of Tremor are affected by CVE-2021-39228?
CVE-2021-39228 affects Tremor versions from 0.7.2 to 0.11.6.
What types of systems are impacted by CVE-2021-39228?
CVE-2021-39228 impacts systems running affected versions of Tremor, typically used for event processing.
What actions should be taken if using Tremor versions 0.7.2 to 0.11.6?
If using Tremor versions 0.7.2 to 0.11.6, it is crucial to upgrade immediately to mitigate the vulnerability.
- agent/references
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/weakness
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/linuxfoundation
- canonical/tremor
- version/tremor/0.7.2