PT-2024-27280 · Unknown · Ydata-Profiling

Published 2024-06-04 · Updated 2024-06-04 · CVE-2024-37064

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ydata-profiling versions 3.7.0 or newer

Description Deserialization of untrusted data can occur in the ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded.

Recommendations For versions 3.7.0 or newer, consider disabling the deserialization of untrusted data as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-37064

GHSA-CG49-HRJ4-3RPR

Affected Products

Ydata-Profiling

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-37064 · Security Note
• https://osv.dev/vulnerability/GHSA-cg49-hrj4-3rpr · Vendor Advisory
• https://github.com/ydataai/ydata-profiling · Note
• https://hiddenlayer.com/sai-security-advisory/ydata-june2024 · Note
• https://t.me/cvenotify/81914 · Telegram Post