CVE-2023-38502 TDengine Database Denial-of-Service
An attacker can crash the TDengine database by submitting a nested UDF query, causing a denial of service for users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38502?
CVE-2023-38502 is a medium-severity denial of service vulnerability in taosdata TDengine, published on 25 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue.
Weakness: CWE-20
Which versions are affected by CVE-2023-38502?
It affects 1 product.
Products include Tdengine Tdengine.
How do I fix CVE-2023-38502?
No fix has been published for CVE-2023-38502 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-38502 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38502 exists.
Other vulnerabilities in taosdata TDengine
Sources
Also known as GHSA-w23f-r2fm-27hf.