CVE-2024-0521: Code Injection in paddlepaddle/paddle
Published Jan 20, 2024
·Updated
Code Injection in paddlepaddle/paddle
Other sources
The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.
— GitHub
Affected Software
2 affected componentsFixes available
pip/paddlepaddle<2.6.0
2.6.0
PaddlePaddle paddle
Remediation
Event History
Jan 20, 2024
CVE Published
via MITRE·08:24 PM
Data Sourced
via MITRE·08:24 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-0521?
CVE-2024-0521 has a high severity due to potential code injection vulnerabilities.
2
How do I fix CVE-2024-0521?
To fix CVE-2024-0521, upgrade to paddlepaddle version 2.6.0 or later.
3
What software is affected by CVE-2024-0521?
CVE-2024-0521 affects the paddlepaddle package prior to version 2.6.0.
4
Can CVE-2024-0521 lead to remote code execution?
Yes, CVE-2024-0521 can allow attackers to inject and execute malicious commands remotely.
5
Is CVE-2024-0521 related to command string construction?
Yes, the vulnerability in CVE-2024-0521 arises from improper validation of the url parameter in command string construction.