CVE-2024-58361: SurrealDB before 2.0.4 Denial of Service via Parser Exception
SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 2.0.4 - Compensating control
Until upgraded, limit/allowlist authorized clients that can execute queries to reduce exposure to malformed queries that trigger the parser error rendering panic.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58361?
The severity of CVE-2024-58361 is rated as medium with a score of 6.5.
How do I fix CVE-2024-58361?
To fix CVE-2024-58361, upgrade SurrealDB to version 2.0.4 or later.
What does CVE-2024-58361 affect?
CVE-2024-58361 affects SurrealDB versions prior to 2.0.4.
What type of vulnerability is CVE-2024-58361?
CVE-2024-58361 is a Denial of Service vulnerability caused by parser exceptions.
Who can exploit CVE-2024-58361?
Authorized clients can exploit CVE-2024-58361 by executing malformed queries with empty string conversions.