CVE-2024-0960

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-0960

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0960.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-0960

Aliases

Published

2024-01-27T12:00:07.334Z

Modified

2026-07-15T01:48:52.381799882Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

flink-extended ai-flow workflow_command.py cloudpickle.loads deserialization

Details

A vulnerability was found in flink-extended ai-flow 0.3.1. It has been declared as critical. Affected by this vulnerability is the function cloudpickle.loads of the file \aiflow\cli\commands\workflowcommand.py. The manipulation leads to deserialization. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-252205 was assigned to this vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0960.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.3.1"
                },
                {
                    "last_affected": "0.3.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/flink-extended/ai-flow

Affected ranges

Type

GIT

Repo

https://github.com/flink-extended/ai-flow

Events

Introduced

97e6830be8463c226a01f62daf7c212bdcbf272a

Last affected

97e6830be8463c226a01f62daf7c212bdcbf272a

Database specific

{
    "cpe": "cpe:2.3:a:flink-extended:aiflow:0.3.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.3.1"
        },
        {
            "last_affected": "0.3.1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

0.*

0.3.1

release-0.*

release-0.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0960.json"