CVE-2024-37065: Skops Python Library Unsafe Deserialization Vulnerability
Summary
CVE-2024-37065: Skops unsafe deserialization. Affects skops versions >= 0.6, <= 0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Skops is a Python library designed for managing and deploying machine learning models. It allows users to easily load, save, and manipulate models in a user-friendly manner. However, versions 0.6 and newer of Skops are vulnerable to unsafe deserialization, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability arises from the deserialization of untrusted data in Skops versions 0.6 or newer. This flaw enables a maliciously crafted model to execute arbitrary code on an end user's system when loaded. The implications of this vulnerability are significant, as it can lead to unauthorized access, data breaches, and system compromise, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid loading models from untrusted sources. If you must load models from external sources, consider implementing additional validation checks to ensure the integrity and safety of the model before deserialization.
Conclusion
The Skops library has a critical vulnerability related to unsafe deserialization that can lead to severe security risks. Users are strongly advised to update to the latest version to mitigate these risks. Additionally, employing best practices for model loading and utilizing tools like Vulert can enhance security measures.
See every vulnerability recorded for skops →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Versions 0.6 to 0.9 of the Skops library are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failing to address this vulnerability can lead to arbitrary code execution, unauthorized access to sensitive data, and potential system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
Related vulnerabilities
Recent vulnerabilities recorded for skops.
