PT-2024-18648 · Zenml Io · Zenml

Published 2024-06-06 · Updated 2024-10-11 · CVE-2024-2032

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions zenml-io/zenml versions up to and including 0.55.3

Description A race condition issue exists, allowing for the creation of multiple users with the same username when requests are sent in parallel. This is due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as the "PUT /api/v1/users/test race" endpoint, where it could lead to further complications.

Recommendations For versions up to and including 0.55.3, update to version 0.55.5 to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint "PUT /api/v1/users/test race" to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-366

CWE-362

Related Identifiers

CVE-2024-2032

GHSA-C546-8JMQ-HPRJ

PYSEC-2024-105

Affected Products

Zenml

References · 10

• https://github.com/zenml-io/zenml/commit/afcaf741ef9114c9b32f722f101b97de3d8d147b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-2032 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-105 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c546-8jmq-hprj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2032 · Vendor Advisory
• https://github.com/zenml-io/zenml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-105.yaml · Note
• https://t.me/cvenotify/97871 · Telegram Post
• https://twitter.com/CVEnew/status/1798795456920858857 · Twitter Post
• https://huntr.com/bounties/6199cd5d-611f-4ea9-96c5-52a952ba5a56 · Note