CVE-2024-5552: ReDoS in kubeflow/kubeflow
kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5552?
CVE-2024-5552 is classified as a medium severity vulnerability due to its nature as a Regular Expression Denial of Service (ReDoS) issue.
How do I fix CVE-2024-5552?
To mitigate CVE-2024-5552, update to a version of Kubeflow that is 1.9.0 or later where the email validation mechanism has been improved.
What components of Kubeflow are affected by CVE-2024-5552?
CVE-2024-5552 affects all versions of Kubeflow prior to 1.9.0.
Can CVE-2024-5552 be exploited without authentication?
Yes, CVE-2024-5552 can be exploited remotely without authentication by passing specially crafted input.
What type of attack is associated with CVE-2024-5552?
CVE-2024-5552 is associated with a Regular Expression Denial of Service (ReDoS) attack that affects the email validation mechanism.