PT-2024-36541 · Kubeflow · Kubeflow

Published 2024-06-06 · Updated 2024-09-23 · CVE-2024-5552

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions kubeflow/kubeflow versions prior to the fixed version

Description The issue is related to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in the email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. The impact of exploiting this vulnerability includes resource exhaustion and service disruption.

Recommendations As a temporary workaround, consider disabling the email validation mechanism until a patch is available. Restrict access to the centraldashboard-angular backend component to minimize the risk of exploitation. Avoid using the vulnerable email validation function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-5552

Affected Products

Kubeflow

References · 6

• 🔥 https://huntr.com/bounties/0c1d6432-f385-4c54-beea-9f8c677def5b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5552 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5552 · Vendor Advisory
• https://twitter.com/CVEnew/status/1798781377242124769 · Twitter Post
• https://t.me/cvenotify/95756 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1798823311876784443 · Twitter Post