Bug 1224468 (CVE-2024-34997)

Summary:	VUL-0: CVE-2024-34997: python-joblib: joblib.numpy_pickle:NumpyArrayWrapper().read_array() use pickle.load on provided data
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED WONTFIX	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	andrea.mattiazzo, daniel.garcia, mcepl
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/406500/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-34997:7.8:(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-05-20 08:09:56 UTC

joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array().

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34997
https://www.cve.org/CVERecord?id=CVE-2024-34997
https://github.com/joblib/joblib/issues/1582

Comment 2 Daniel Garcia 2024-05-20 12:16:29 UTC

Possible fix: https://github.com/joblib/joblib/pull/1585

Comment 4 Daniel Garcia 2024-05-21 06:09:36 UTC

Moving back to security, I think we can close this as WONTFIX

Comment 5 Andrea Mattiazzo 2024-05-21 07:42:22 UTC

Closing as WONT FIX since the security risk rise only on a bad usage of the library and this risk is highlighted both in code and documentation page. [0]

[0] https://joblib.readthedocs.io/en/stable/generated/joblib.load.html#joblib.load