CVE-2021-39228

Source
https://nvd.nist.gov/vuln/detail/CVE-2021-39228
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39228.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-39228
Aliases
Related
Published
2021-09-17T14:15:08Z
Modified
2025-01-14T22:02:15Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using patch or merge on state and assign the result back to state. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the state, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to state.

References

Affected packages

Git / github.com/tremor-rs/tremor-runtime

Affected ranges

Type
GIT
Repo
https://github.com/tremor-rs/tremor-runtime
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed