CVE-2024-58357

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...

CVE-2024-58357 SurrealDB before 2.1.0 Denial of Service via rand::time()

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...

CVE-2024-58357

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...

CVE-2024-58357 SurrealDB before 2.1.0 Denial of Service via rand::time()

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...

CVE-2024-58357 SurrealDB before 2.1.0 Denial of Service via rand::time()

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...

CVE-2024-58357

CVE-2024-58357 affects SurrealDB versions before 2.1.0. The vulnerability is an uncaught exception in the Rust rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to trigger server panics, causing denia...

CVE-2026-8503

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand function, the epoch time, and the PID, that is hashed...

SurrealDB has an Uncaught Exception in Function Generating Random Time

The rand::time function in SurrealQL generates a random time from an optional range of two Unix timestamps. Due to the underlying use of timestampopt from the chrono crate, this function could potentially return None in some instances, leading to a panic when unwrap was called on its result in...

GHSA-H4F5-H82V-5W4R SurrealDB has an Uncaught Exception in Function Generating Random Time

The rand::time function in SurrealQL generates a random time from an optional range of two Unix timestamps. Due to the underlying use of timestampopt from the chrono crate, this function could potentially return None in some instances, leading to a panic when unwrap was called on its result in...

PT-2024-40311 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.1.0 Description: The issue arises from the rand::time function in SurrealQL, which can potentially return None and cause a panic when unwrap is called, leading to a denial of service. An authorized client can mak...