PT-2024-15922 · Van Der Schaar · Synthcity

Bayuncao · Published 2024-01-26 · Updated 2024-05-17 · CVE-2024-0937

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions van der Schaar LAB synthcity version 0.2.9

Description A critical issue has been found in the function load from file of the component PKL File Handler, leading to deserialization. The attack may be launched remotely. The vendor was contacted and confirmed the existence of the issue. A patch is planned to be released.

Recommendations For van der Schaar LAB synthcity version 0.2.9, consider disabling the load from file function of the PKL File Handler until a patch is available. Wait for the official patch release planned for February 2024.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-0937

GHSA-4957-7VHP-7V59

Affected Products

Synthcity

References · 11

• 🔥❌ https://github.com/bayuncao/vul-cve-6/blob/main/poc.py · Exploit, Deleted
• 🔥❌ https://github.com/bayuncao/vul-cve-6 · Exploit, Deleted
• https://osv.dev/vulnerability/GHSA-4957-7vhp-7v59 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0937 · Security Note
• https://github.com/vanderschaarlab/synthcity/blob/73cfd8ca784f70141fc7f2969221cd3b5737f7b1/src/synthcity/utils/serialization.py#L30 · Note
• https://github.com/vanderschaarlab/synthcity · Note
• https://twitter.com/CVEnew/status/1750936050959057319 · Twitter Post
• https://vuldb.com/?ctiid.252182 · Note
• https://twitter.com/VulmonFeeds/status/1750967033724801059 · Twitter Post
• https://vuldb.com/?id.252182 · Note