CVE-2024-9070: Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml
A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9070?
CVE-2024-9070 is classified as a critical vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2024-9070?
To fix CVE-2024-9070, upgrade BentoML to version 1.3.4.post2 or later.
What software is affected by CVE-2024-9070?
CVE-2024-9070 affects BentoML versions up to and including 1.3.4.post1.
Can CVE-2024-9070 lead to data breaches?
Yes, CVE-2024-9070 can lead to severe data breaches by allowing attackers to execute unauthorized code.
How can I detect if my system is vulnerable to CVE-2024-9070?
You can detect vulnerability to CVE-2024-9070 by checking the installed version of BentoML against the affected version list.