VulnerabilityDeferred

CVE-2024-50050

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution.

MEDIUM 6.3EPSS 0.87%

Does this matter?

Lower severity and a low EPSS score (0.87%). Track it; it rarely justifies an emergency change on its own.

Description

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead.

CVSS 3.1: 6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.87% probability · 57th percentile
CISA KEV: Not listed
Source: cve-assign@fb.com

References

https://www.facebook.com/security/advisories/cve-2024-50050

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.