PT-2024-38028 · Unknown · Mudler/Localai

CVE-2024-7010 · Published 2024-10-29 · Updated 2024-11-14

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mudler/localai version 2.17.1

Description The issue is a Timing Attack, a type of side-channel attack that allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. In the context of password handling, an attacker can determine valid login credentials based on the server's response time, potentially leading to unauthorized access.

Recommendations For mudler/localai version 2.17.1, consider implementing measures to mitigate timing attacks, such as adding random delays to the server's response time or using a constant-time comparison function for password verification. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

CVE-2024-7010

Affected Products

Mudler/Localai

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7010.json · Exploit
• 🔥 https://huntr.com/bounties/e286ed00-6383-47de-b5bc-9b9fad67c362 · Exploit
• https://github.com/mudler/localai/commit/db1159b6511e8fa09e594f9db0fec6ab4e142468 · Patch
• https://osv.dev/vulnerability/CVE-2024-7010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7010 · Security Note
• https://t.me/cvenotify/101685 · Telegram Post
• https://t.me/cvedetector/9321 · Telegram Post