Description
A vulnerability has been found in Tarantool up to 3.3.1 and classified as problematic. Affected by this vulnerability is the function tm_to_datetime in the library src/lib/core/datetime.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Tarantool | 3.3.0, 3.3.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | tarantool | No fix yet | — |
| Debian 12 | tarantool | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | tarantool | No fix yet | — |
| Ubuntu 24.04 LTS | tarantool | No fix yet | — |
| Ubuntu 22.04 LTS | tarantool | No fix yet | — |
| Ubuntu 20.04 LTS | tarantool | No fix yet | — |
| Ubuntu 16.04 LTS | tarantool | No fix yet | — |
References
- VDB-313663 | Tarantool datetime.c tm_to_datetime assertion vdb-entry technical-description
- VDB-313663 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #597454 | tarantool tarantool 3.3.1 (commit 46cc98b) Reachable Assertion third-party-advisory
- https://github.com/tarantool/tarantool/issues/11347 issue-tracking
- https://github.com/user-attachments/files/19613858/tarantool_crash.txt exploit