PatchTheCVEtidb vulnerabilities and fixes
Recent CVEs affecting tidb, with upgrade or downgrade steps. 4 tracked.
tidb has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2024-09-03. Highest priority: CVE-2024-41433 (score 56/100).
- CVE-2024-41434 MEDIUM 4.3 DOWNGRADE PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal
- CVE-2024-41433 CRITICAL 9.8 DOWNGRADE PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpression
- CVE-2024-35618 HIGH 7.5 DOWNGRADE PingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer.
- CVE-2024-33809 MEDIUM 6.5 DOWNGRADE PingCAP TiDB v7.5.1 was discovered to contain a buffer overflow vulnerability, which could lead to database cr
FAQ
How do I fix tidb vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tidb being exploited right now?
None of the tracked tidb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tidb CVE should I patch first?
CVE-2024-41433 currently ranks highest (56/100): PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpression.