joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.
References
Configurations
No configuration.
History
21 Nov 2024, 09:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/joblib/joblib/issues/1582 - | |
| References | () https://github.com/joblib/joblib/issues/977 - |
27 Aug 2024, 15:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-502 |
17 Jun 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary |
|
|
| Summary | (en) joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content. |
17 May 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-17 19:15
Updated : 2024-11-21 09:19
NVD link : CVE-2024-34997
Mitre link : CVE-2024-34997
CVE.ORG link : CVE-2024-34997
JSON object : View
Products Affected
No product.
CWE
CWE-502
Deserialization of Untrusted Data