PT-2024-40247 · Ibm · Qiskit Ibm Runtime

Published 2024-03-20 · Updated 2024-03-20

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Qiskit-IBM-Runtime (affected versions not specified)

Description: A security issue exists due to the use of an eval() method in Options. get program inputs, which can lead to arbitrary code injection in runtime containers. This is particularly concerning because Options are used server-side. A local exploit can be created by constructing a specifically designed CouplingMap subclass, allowing for the execution of arbitrary Python code.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-627

Related Identifiers

GHSA-CQ96-9974-V8HM

Affected Products

Qiskit Ibm Runtime

References · 4

• https://osv.dev/vulnerability/GHSA-cq96-9974-v8hm · Vendor Advisory
• https://github.com/Qiskit/qiskit-ibm-runtime · Note
• https://github.com/Qiskit/qiskit-ibm-runtime/security/advisories/GHSA-cq96-9974-v8hm · Note
• https://github.com/Qiskit/qiskit-ibm-runtime/commit/2e8c8c8df83ba310f52d1651a426bad879e0bd38 · Note