CVE-2024-50050

Description

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead.

Reserved 2024-10-21 | Published 2024-10-23 | Updated 2024-10-24 | Assigner facebook

Problem types

Deserialization of Untrusted Data (CWE-502)

Product status

Default status
unaffected

Any version before 7a8aa775e5a267cf8660d83140011a0b7f91e005
affected

References

www.facebook.com/security/advisories/cve-2024-50050

cve.org (CVE-2024-50050)

nvd.nist.gov (CVE-2024-50050)

Download JSON