RedisTimeSeries Integer Overflow Vulnerability Leading to Remote Code Execution

A vulnerability in RedisTimeSeries, a time-series database module for Redis, allows for remote code execution. This issue arises from an integer overflow followed by a heap overflow, which can be triggered by an authenticated user executing certain commands (TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE) with specially crafted arguments. The vulnerability affects RedisTimeSeries versions 1.0.0 and newer, except for the patched versions in 1.8.16, 1.10.16 and 1.12.5.

Impact

Exploitation of this vulnerability can lead to remote code execution on the server where RedisTimeSeries is running.

Remediation

Users can upgrade to RedisTimeSeries versions 1.8.16, 1.10.16, or 1.12.5 to address this vulnerability.