PT-2024-15940 · Unknown · Cloudpickle+1

Bayuncao · Published 2024-01-27 · Updated 2024-05-17 · CVE-2024-0960

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions flink-extended ai-flow version 0.3.1

Description A critical issue has been found, affecting the function cloudpickle.loads of the file ai flowclicommandsworkflow command.py. This issue leads to deserialization and can be exploited remotely. The complexity of an attack is rather high, and the exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Recommendations For flink-extended ai-flow version 0.3.1, consider disabling the cloudpickle.loads function as a temporary workaround until a patch is available. Restrict access to the vulnerable file ai flowclicommandsworkflow command.py to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-0960

GHSA-7MGG-3RQ2-HFF4

Affected Products

Cloudpickle

Flink-Extended Ai-Flow

References · 11

• 🔥❌ https://github.com/bayuncao/vul-cve-8 · Exploit, Deleted
• 🔥❌ https://github.com/bayuncao/vul-cve-8/blob/main/dataset.pkl · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2024-0960 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7mgg-3rq2-hff4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0960 · Security Note
• https://github.com/flink-extended/ai-flow · Note
• https://twitter.com/VulmonFeeds/status/1751238914256335024 · Twitter Post
• https://twitter.com/CVEnew/status/1751219422239359131 · Twitter Post
• https://vuldb.com/?ctiid.252205 · Note
• https://vuldb.com/?id.252205 · Note
• https://t.me/cvenotify/69004 · Telegram Post