Skip to content
OpenAdvisories
Medium · 4.9 CVE-2024-32886 EUVD-2024-1448GHSA-649x-hxfx-57j2GO-2024-2826

Vitess vulnerable to infinite memory consumption and vtgate crash

Published May 8, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: vitessio Product: vitess Package: github.com/vitessio/vitess Package: vitess Package: vitess.io/vitess Ecosystem: Azure Linux Ecosystem: Go

Description

Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.

Affected products

VendorProductAffectedFixed
vitessio vitess < 17.0.7, >= 18.0.0, < 18.0.5, >= 19.0.0, < 19.0.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vitess 19.0.4-1 —
Azure Linux 2 (CBL-Mariner) vitess 17.0.7-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/vitessio/vitess >= 19.0.0, < 19.0.4 19.0.4 GHSA-649x-hxfx-57j2
Go github.com/vitessio/vitess >= 18.0.0, < 18.0.5 18.0.5 GHSA-649x-hxfx-57j2
Go github.com/vitessio/vitess < 17.0.7 17.0.7 GHSA-649x-hxfx-57j2
Go vitess.io/vitess < 0.17.7 0.17.7 GHSA-649x-hxfx-57j2
Go vitess.io/vitess >= 0.18.0, < 0.18.5 0.18.5 GHSA-649x-hxfx-57j2
Go vitess.io/vitess >= 0.19.0, < 0.19.4 0.19.4 GHSA-649x-hxfx-57j2
Go vitess.io/vitess < 0.17.7 · >= 0.18.0, < 0.18.5 · >= 0.19.0, < 0.19.4 0.17.7, 0.18.5, 0.19.4 GO-2024-2826

References