CVE-2024-3829: Input validation failure in Qdrant snapshot recovery

# CVE-2024-3829: Input validation failure in Qdrant snapshot recovery

https://gcdradar.vercel.app/incidents/cve-2024-3829-input-validation-failure-in-qdrant-snapshot-re · AIR-2024-0114 · closed 2024-06-03

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-06-03
- AI role: Attack on AI
- Products: Qdrant
- CVE ids: CVE-2024-3829
- CVSS: 9.8

## Summary

Qdrant is vulnerable to arbitrary file read and write during snapshot recovery due to unsafe handling of symlinks. Exploitation could allow attackers to compromise the underlying system.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-06-03: CVE-2024-3829: qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. (https://nvd.nist.gov/vuln/detail/CVE-2024-3829)
- 2024-06-03: CVE-2024-3829: qdrant input validation failure  (https://github.com/advisories/GHSA-7m75-x27w-r52r)

## Sources

- 2024-06-03 GitHub Advisory Database: CVE-2024-3829: qdrant input validation failure  https://github.com/advisories/GHSA-7m75-x27w-r52r
- 2024-06-03 NVD: CVE-2024-3829: qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. https://nvd.nist.gov/vuln/detail/CVE-2024-3829

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.