VictoriaMetrics v1.136.12 Vulnerability Advisory: Data Corruption and Privilege Bypass Fixes

Vulnerability Overview In VictoriaMetrics version v1.136.12, multiple security vulnerabilities exist, primarily involving data corruption, permission bypasses, and potential security risks. Affected Components stream aggregation: May lead to data corruption when aggregation data with identical timestamps is generated. vmalert, vmalertmanager, and vmalert: May cause unbounded shutdown latency when the configuration reload delay exceeds . vmselect and vmstorage: May cause metadata corruption in VictoriaMetrics clusters when responses contain multiple rows. vminsert and vmselect: May incorrectly apply long tenant filters in VictoriaMetrics clusters, leading to incorrect tenant matching. vmbackup and vmbackupmanager: May result in data loss if backups are not performed when the target directory does not exist. vminsert and vmstorage: Prevents panics during directory deletion in VictoriaMetrics clusters, particularly on NFS-based mounts. vmctl: May result in metrics not being pushed in the event of migration failure. vmrestore: Allows restoration of parts outside the configured directory, potentially leading to data leakage. Remediation stream aggregation: Fixes the issue with generated aggregation data having identical timestamps. vmalert, vmalertmanager, and vmalert: Optimizes configuration reload delay handling. vmselect and vmstorage: Fixes metadata corruption issues. vminsert and vmselect: Correctly applies long tenant filters. vmbackup and vmbackupmanager: Ensures backups are performed even if the directory does not exist. vminsert and vmstorage: Prevents panics during directory deletion. vmctl: Pushes metrics even in the event of migration failure. vmrestore: Restricts restoration operations within the configured directory. POC Code or Exploit Code No specific POC code or exploit code was provided on the page. Summary VictoriaMetrics version v1.136.12 contains multiple security vulnerabilities, primarily involving data corruption, permission bypasses, and potential security risks. Users are advised to upgrade to the latest version as soon as possible to resolve these issues.

Goal Reached Thanks to every supporter — we hit 100%!

VictoriaMetrics v1.136.12 Vulnerability Advisory: Data Corruption and Privilege Bypass Fixes

More from this source