SurrealDB use-after-free and authorization and request forgery flaws
Logged-in SurrealDB users can peek at restricted data.
Summary
SurrealDB before 3.3.0 has a use-after-free flaw and several authorization and request forgery flaws. The memory flaw affects Rust programs that embed SurrealDB directly, while the others let logged-in users peek at restricted data or reach internal services.
Affected when
- Rust programs that embed the SurrealDB core
- Users with login accounts on the system
What to do
Update to SurrealDB 3.3.0.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen