TechPrufer
Get started
Qdrant
Qdrant logoQdrant · Feature trail

Security Vulnerability Response

2 posts · Apr 2024 – Jun 2024

What this trail covers

Qdrant continues to enhance its security posture by addressing vulnerabilities. Following CVE-2024-2221, the company has now patched CVE-2024-3829, an arbitrary file upload vulnerability affecting versions prior to v1.9.0. The fix restricts file uploads to a dedicated folder, and Qdrant cloud deployments were not materially affected due to read-only filesystems and default authentication. Users are advised to upgrade to v1.9.0 or above.

All Qdrant trails
  1. Response to CVE-2024-3829: Arbitrary file upload vulnerability - QdrantThis post details the response to CVE-2024-3829, an arbitrary file upload vulnerability in Qdrant versions prior to v1.9.0. It explains the vulnerability, its impact (remote code execution), and the mitigation strategy: restricting file uploads to a dedicated folder in v1.9.0 and above. It also clarifies that Qdrant cloud deployments were not significantly affected due to existing security measures. The post provides clear action items for users to check their version and upgrade if necessary, with specific instructions for container/binary, Helm chart, and cloud deployments.
  2. Response to CVE-2024-2221: Arbitrary file upload vulnerability - QdrantDetails the resolution of CVE-2024-2221, an arbitrary file upload vulnerability affecting Qdrant versions prior to v1.9.0. The vulnerability allowed remote code execution. The fix involves restricting file uploads to a dedicated folder in v1.9.0 and above. Qdrant cloud deployments are noted as not materially affected due to read-only filesystems and default authentication. Users are instructed to upgrade to v1.9.0 or later.