Tremor Runtime
Approved changes feed: RSS · Atom
cpe:2.3:a:tremor-rs:tremor-runtime:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Tremor Rs (d11047d4-d44e-5c93-944a-b1b7cbd07007) |
|---|---|
| Product | Tremor Runtime (ad9bb602-5431-5a2f-9d80-ee3061fe804b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-39228 |
vulnerable | 2026-06-08 05:33:49.231398 |
Memory Safety Issue when using patch or merge on state and assign the result back to state
MEDIUM (6.5)
Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to `state`.
Published: 2021-09-17T14:00:15.000Z
Updated: 2024-08-04T01:58:18.328Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.