CVE-2024-50050

{"id": "CVE-2024-50050", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2024-10-23T14:15:05.087", "references": [{"url": "https://www.facebook.com/security/advisories/cve-2024-50050", "source": "cve-assign@fb.com"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead."}, {"lang": "es", "value": "Antes de la revisi\u00f3n 7a8aa775e5a267cf8660d83140011a0b7f91e005, Llama Stack utilizaba pickle como formato de serializaci\u00f3n para la comunicaci\u00f3n por socket, lo que potencialmente permit\u00eda la ejecuci\u00f3n remota de c\u00f3digo. La comunicaci\u00f3n por socket se modific\u00f3 para utilizar JSON en su lugar."}], "lastModified": "2024-10-24T19:35:08.107", "sourceIdentifier": "cve-assign@fb.com"}