PT-2024-27143 · Oneflow · Oneflow

Published 2024-06-06 · Updated 2024-10-15 · CVE-2024-36735

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oneflow version 0.9.1

Description The issue concerns the oneflow.eye parameter being floating, which does not trigger an error or warning.

Recommendations For version 0.9.1, consider restricting the use of the oneflow.eye parameter to minimize potential issues until a fix is available.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2024-36735

Affected Products

Oneflow

References · 4

• https://osv.dev/vulnerability/CVE-2024-36735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36735 · Security Note
• https://twitter.com/CVEnew/status/1798789752415768853 · Twitter Post
• https://gist.github.com/Redmept1on/4998e9b6435448cea07a8b2dbf96eedc · Note