CVE-2024-10190
CVE-2024-10190 · Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
CVSS 9.8 · Critique · EPSS 1,1%
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
horovod/horovod
- Versions du logiciel
- ≥ unspecified, ≤ latest: Concernée (custom)
Aucun correctif publié
horovod PyPI
- Versions du logiciel
- 0.10.0
- 0.10.1
- 0.10.2
- 0.11.0
- 0.11.1
- 0.11.2
- 0.11.3
- 0.12.0
- 0.12.1
- 0.13.0
- 0.13.1
- 0.13.10
- 0.13.11
- 0.13.2
- 0.13.3
- 0.13.4
- 0.13.5
- 0.13.6
- 0.13.7
- 0.13.8
- 0.14.0
- 0.14.1
- 0.15.0
- 0.15.1
- 0.15.2
- 0.16.0
- 0.16.1
- 0.16.2
- 0.16.3
- 0.16.4
- 0.18.0
- 0.18.1
- 0.18.2
- 0.19.0
- 0.19.1
- 0.19.2
- 0.19.3
- 0.19.4
- 0.19.5
- 0.20.0
- 0.20.1
- 0.20.2
- 0.20.3
- 0.21.0
- 0.21.1
- 0.21.2
- 0.21.3
- 0.22.0
- 0.22.1
- 0.23.0
- 0.24.0
- 0.24.1
- 0.24.2
- 0.24.3
- 0.25.0
- 0.26.0
- 0.26.1
- 0.27.0
- 0.28.0
- 0.28.1
- 0.9.0
- 0.9.1
- 0.9.10
- 0.9.11
- 0.9.12
- 0.9.2
- 0.9.3
- 0.9.4
- 0.9.5
- 0.9.6
- 0.9.7
- 0.9.8
- 0.9.9
- Plages de versions concernées
- ECOSYSTEM: ≤ 0.28.1
Aucun correctif publié