Description (CNA)
Valkey-Bloom is a Rust based Valkey module which brings a Bloom Filter (Module) data type into the Valkey distributed key-value database. Prior to commit a68614b6e3845777d383b3a513cedcc08b3b7ccd, a specially crafted `RESTORE` command can cause Valkey to hit an assertion, causes the server to shutdown. Valkey modules are required to handle errors in RDB parsing by using `VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS` flag. If this flag is not set, errors encountered during parsing result in a system assertion which shuts down the system. Even though the Valkey-bloom module correctly handled the parsing, it did not originally set the flag. Commit a68614b6e3845777d383b3a513cedcc08b3b7ccd contains a patch. One may mitigate this defect by disabling the `RESTORE` command if it is unused by one's application.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| valkey-io / valkey-bloom | affected < a68614b6e3845777d383b3a513cedcc08b3b7ccd |
CWE
CWE-20
References
- https://github.com/valkey-io/valkey-bloom/security/advisories/GHSA-mc2g-h759-3qw2
- https://github.com/valkey-io/valkey-bloom/commit/a68614b6e3845777d383b3a513cedcc08b3b7ccd
ADP enrichment
No English description supplied.
No references supplied.