2025-03-23 03:03:54 +00:00

60 lines
2.5 KiB
JSON

{
"id": "CVE-2024-10190",
"sourceIdentifier": "security@huntr.dev",
"published": "2025-03-20T10:15:15.117",
"lastModified": "2025-03-20T10:15:15.117",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server."
},
{
"lang": "es",
"value": "Las versiones de Horovod hasta la v0.28.1 incluida son vulnerables a la ejecuci\u00f3n remota de c\u00f3digo no autenticado. Esta vulnerabilidad se debe a la gesti\u00f3n inadecuada de datos codificados en base64 en `ElasticRendezvousHandler`, una subclase de `KVStoreHandler`. Espec\u00edficamente, el m\u00e9todo `_put_value` de `ElasticRendezvousHandler` llama a `codec.loads_base64(value)`, que finalmente invoca a `cloudpickle.loads(decoded)`. Esto permite a un atacante enviar un objeto pickle malicioso mediante una solicitud PUT, lo que provoca la ejecuci\u00f3n de c\u00f3digo arbitrario en el servidor."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@huntr.dev",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "security@huntr.dev",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"references": [
{
"url": "https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754",
"source": "security@huntr.dev"
}
]
}