PT-2025-9703 · Unknown · Vllm Aibrix

Kexinoh · Publicado 2025-03-04 · Atualizado 2025-03-05 · CVE-2025-1953

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Baixa

Vetor base

AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions vLLM AIBrix version 0.2.0

Description A vulnerability has been found in the Prefix Caching component, specifically in the file pkg/plugins/gateway/prefixcacheindexer/hash.go. This issue leads to insufficiently random values. The complexity of an attack is rather high, and the exploitation appears to be difficult.

Recommendations For vLLM AIBrix version 0.2.0, upgrade to version 0.3.0 to address this issue. It is recommended to upgrade the affected Prefix Caching component.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

CWE-310

Identificadores relacionados

CVE-2025-1953

Produtos afetados

Vllm Aibrix

Referências · 12

• https://github.com/vllm-project/aibrix/issues/749#event-16488517974 · Correção
• https://github.com/vllm-project/aibrix/pull/752/commits/3d25d95aebd66f24a549200edcebc5ea423b317a · Correção
• https://github.com/vllm-project/aibrix/issues/749 · Nota
• https://github.com/vllm-project/aibrix/pull/752 · Nota
• https://t.me/cvedetector/19537 · Publicação no Telegram
• https://vuldb.com/?id.298543 · Nota
• https://vuldb.com/?ctiid.298543 · Nota
• https://twitter.com/VulmonFeeds/status/1897124131054764137 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-1953 · Aviso do Fabricante
• https://vuldb.com/?submit.509958 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-1953 · Nota de Segurança
• https://twitter.com/CVEnew/status/1897133263568748677 · Publicação no Twitter