Denial Of Service (DoS)

BentoML is vulnerable to Denial of Service DoS. The vulnerability is due to improper request handling due to the server continuously processing appended characters in a multipart boundary of an HTTP request, leading to excessive resource consumption and service unavailability...

CVE-2024-12759

In bentoml/bentoml version 1.3.9, the /login endpoint of the newly integrated Gradio app is vulnerable to a Denial of Service DoS attack. This vulnerability can be exploited by appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request. The server continuously...

CVE-2024-9056

BentoML version v1.3.4post1 is vulnerable to a Denial of Service DoS attack. The vulnerability can be exploited by appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive...

CVE-2024-9070

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

openlayer (0.0.0a0), sentencebertservice (20211205152102.0.0) +1 more potentially affected by CVE-2024-9056 via bentoml (0.13.1)

bentoml PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - openlayer 0.0.0a0 - sentencebertservice 20211205152102.0.0 - unboxapi =0.1.1, =0.3.0 Source cves: CVE-2024-9056 Source advisory:...

ai-dynamo (0.1.0), bentoctl (0.2.3) +6 more potentially affected by CVE-2024-9070 via bentoml (>=1.0.0a7, <=1.4.3)

bentoml PYPI version =1.0.0a7, =1.0.1, =0.3.12.dev20240709150559, =0.0.1, =1.0.3, =0.0.10, =0.6.20 - raptor-labsdk 0.3.2 Source cves: CVE-2024-9070 Source advisory: GHSA-9G44-GWVM-HC44...

BentoML deserialization vulnerability

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

Deserialization of Untrusted Data

Overview bentoml is a BentoML: Build Production-Grade AI Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the args-number parameter. An attacker can execute unauthorized arbitrary code on the server by setting a value greater than 1 to the...

bentoutils (0.0.10), ersilia (>=0.0.1, <=0.0.3) +3 more potentially affected by CVE-2024-9056 via bentoml (0.9.2)

bentoml PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bentoutils 0.0.10 - ersilia =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2024-9056 Source advisory: OSV:GHSA-HW8J-HW49-752C...

GHSA-HW8J-HW49-752C BentoML Denial of Service (DoS) via Multipart Boundary

BentoML version v1.3.4post1 is vulnerable to a Denial of Service DoS attack. The vulnerability can be exploited by appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive...

ai-dynamo (0.1.0), bentoctl (0.2.3) +6 more potentially affected by CVE-2024-9056 via bentoml (>=1.0.0a7, <=1.4.3)

bentoml PYPI version =1.0.0a7, =1.0.1, =0.3.12.dev20240709150559, =0.0.1, =1.0.3, =0.0.10, =0.6.20 - raptor-labsdk 0.3.2 Source cves: CVE-2024-9056 Source advisory: OSV:GHSA-HW8J-HW49-752C...

bentoutils (>=0.0.35, <=0.1.1), qandaxfmrartifact (>=0.0.6, <=0.0.7) +3 more potentially affected by CVE-2024-9056 via bentoml (0.10.1)

bentoml PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bentoutils =0.0.35, =0.0.6, =0.0.5, =0.0.3, =0.0.4 Source cves: CVE-2024-9056 Source advisory: OSV:GHSA-HW8J-HW49-752C...

ai-dynamo (0.1.0), bentoctl (0.2.3) +6 more potentially affected by CVE-2024-9056 via bentoml (>=1.0.0a7, <=1.4.3)

bentoml PYPI version =1.0.0a7, =1.0.1, =0.3.12.dev20240709150559, =0.0.1, =1.0.3, =0.0.10, =0.6.20 - raptor-labsdk 0.3.2 Source cves: CVE-2024-9056 Source advisory: GHSA-HW8J-HW49-752C...

openlayer (0.0.0a0), sentencebertservice (20211205152102.0.0) +1 more potentially affected by CVE-2024-9070 via bentoml (0.13.1)

bentoml PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - openlayer 0.0.0a0 - sentencebertservice 20211205152102.0.0 - unboxapi =0.1.1, =0.3.0 Source cves: CVE-2024-9070 Source advisory:...

GHSA-9G44-GWVM-HC44 BentoML deserialization vulnerability

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

bentoutils (>=0.0.35, <=0.1.1), qandaxfmrartifact (>=0.0.6, <=0.0.7) +3 more potentially affected by CVE-2024-9070 via bentoml (0.10.1)

bentoml PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bentoutils =0.0.35, =0.0.6, =0.0.5, =0.0.3, =0.0.4 Source cves: CVE-2024-9070 Source advisory: OSV:GHSA-9G44-GWVM-HC44...

ersilia (>=0.0.5, <=0.1.1) potentially affected by CVE-2024-9070 via bentoml (0.11.0)

bentoml PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - ersilia =0.0.5, =0.1.1 Source cves: CVE-2024-9070 Source advisory: OSV:GHSA-9G44-GWVM-HC44...

bento2seldon (>=0.1.0, <=0.4.0), bento2seldon4recsys (>=0.1.0, <=0.1.3) potentially affected by CVE-2024-9070 via bentoml (0.12.1)

bentoml PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bento2seldon =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2024-9070 Source advisory: OSV:GHSA-9G44-GWVM-HC44...

bentoutils (0.0.10), ersilia (>=0.0.1, <=0.0.3) +3 more potentially affected by CVE-2024-9070 via bentoml (0.9.2)

bentoml PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bentoutils 0.0.10 - ersilia =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2024-9070 Source advisory: OSV:GHSA-9G44-GWVM-HC44...

ai-dynamo (0.1.0), bentoctl (0.2.3) +6 more potentially affected by CVE-2024-9070 via bentoml (>=1.0.0a7, <=1.4.3)

bentoml PYPI version =1.0.0a7, =1.0.1, =0.3.12.dev20240709150559, =0.0.1, =1.0.3, =0.0.10, =0.6.20 - raptor-labsdk 0.3.2 Source cves: CVE-2024-9070 Source advisory: OSV:GHSA-9G44-GWVM-HC44...