CVE-2024-34997: joblib Deserialization Vulnerability in Caching Mechanism
Summary
CVE-2024-34997: joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). Affects joblib versions 0.10.0 – 1.5.3. No fix is published. How to fix ↓
Also tracked for
- joblib · Debian:11
The same CVE-2024-34997 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
joblib is a Python library designed for lightweight pipelining in Python, primarily used for saving and loading large data structures efficiently. It provides tools for parallel computing and is widely utilized in data science and machine learning applications. The library's caching mechanism, which employs NumpyArrayWrapper, is intended to optimize performance by storing computed results. However, this mechanism has been identified as vulnerable to deserialization attacks, raising concerns about the integrity and security of cached content.
Vulnerability Detail
The vulnerability in joblib v1.4.2 arises from a deserialization flaw in the NumpyArrayWrapper component, specifically in the read_array() method. This flaw could allow an attacker to exploit the deserialization process, potentially leading to arbitrary code execution or data corruption. Although the supplier disputes the severity of this issue, claiming that NumpyArrayWrapper is only used for caching trusted content, the risk remains significant, especially in environments where untrusted data may be processed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling the caching feature of joblib or ensuring that only trusted data is processed. This can be done by avoiding the use of joblib's caching mechanisms in scenarios where untrusted input may be present.
Conclusion
The deserialization vulnerability identified in joblib v1.4.2 poses a significant risk, particularly in scenarios involving untrusted data. Users are strongly advised to update to a patched version to safeguard their applications. For those unable to upgrade immediately, implementing workarounds can help mitigate potential risks.
See every vulnerability recorded for joblib →
FAQ
CVE-2024-34997 is a vulnerability in joblib that allows for potential deserialization attacks via the NumpyArrayWrapper component.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to arbitrary code execution or data corruption, especially if untrusted data is processed.
Yes, updating joblib to a version later than 1.4.2 will resolve the vulnerability.
Consider disabling joblib's caching feature or ensuring that only trusted data is processed to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for joblib.
