PT-2024-20042 · Unknown · Embedchain

Yusuke Justin Nakajima · Published 2024-01-21 · Updated 2024-01-26 · CVE-2024-23732

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Embedchain versions prior to 0.1.57

Description The issue allows a ReDoS (regular expression denial of service) via a long string to json.py. This occurs in the JSON loader of Embedchain.

Recommendations For versions prior to 0.1.57, update to version 0.1.57 or later to resolve the issue. As a temporary workaround, consider restricting input to the JSON loader to prevent long strings from being processed.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-23732

GHSA-R67W-F99W-MGXJ

PYSEC-2024-8

Affected Products

Embedchain

References · 10

• https://github.com/embedchain/embedchain/compare/0.1.56...0.1.57 · Patch
• https://github.com/embedchain/embedchain/pull/1122 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-23732 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r67w-f99w-mgxj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23732 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/embedchain/PYSEC-2024-8.yaml · Note
• https://twitter.com/CVEnew/status/1749118141161259028 · Twitter Post
• https://t.me/cvenotify/68168 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1749154543298830481 · Twitter Post