58 matches found
Deserialization of Untrusted Data
Overview qiskit-terra is a Software for developing quantum computing programs Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization of QPY files containing malformed symengine serialization streams. An attacker can terminate the process by...
GHSA-FPMR-M242-XM7X Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit
Impact A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payloa...
CVE-2025-1403
Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library...
CVE-2025-1403
Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library...
CVE-2025-1403
CVE-2025-1403 affects Qiskit SDK from 0.45.0 to 1.2.4, where a malicious QPY file with a malformed symengine serialization stream can trigger a segfault in the symengine library, enabling remote denial of service. The Red Hat, OSV, and IBM advisories confirm the vulnerability and provide remediat...
CVE-2025-1403 Qiskit SDK denial of service
Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library...
CVE-2025-1403 Qiskit SDK denial of service
Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library...
PT-2025-7502
Name of the Vulnerable Software and Affected Versions Qiskit SDK versions 0.45.0 through 1.2.4 Description A maliciously crafted QPY file containing a malformed symengine serialization stream can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process...
CVE-2024-29032
Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using qiskitibmruntime.RuntimeDecoder can lead to arbitrary code...
CVE-2024-29032 `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code
Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using qiskitibmruntime.RuntimeDecoder can lead to arbitrary code...
CVE-2024-29032
Qiskit IBM Runtime is affected by a vulnerability in the JSON deserialization path of qiskit_ibm_runtime.RuntimeDecoder. In versions starting from 0.1.0 up to but before 0.21.2, deserializing a specially crafted JSON string can lead to arbitrary code execution. The issue is fixed in version 0.21....
CVE-2024-29032 `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code
Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using qiskitibmruntime.RuntimeDecoder can lead to arbitrary code...
bosonic-qiskit (>=0.0.0 <=12.2.6), iqm-benchmarks (>=1.3.0 <=1.6.0) +5 more potentially affected by CVE-2024-29032 via qiskit-ibm-runtime (=0.20.0)
qiskit-ibm-runtime PYPI version =0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on qiskit-ibm-runtime and may be impacted: - bosonic-qiskit =0.0.0, =1.3.0, =0.35.1, =0.3.0, =0.14.0, =0.1.6, =0.1.10 Source cves: CVE-2024-29032 Source advisory:...
`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code
Summary deserializing json data using qiskitibmruntime.RuntimeDecoder can be made to execute arbitrary code given a correctly formatted input string Details RuntimeDecoder is supposed to be able to deserialize JSON strings containing various special types encoded via RuntimeEncoder. However, one...
Dynamic Variable Evaluation in qiskit-ibm-runtime
Summary An eval method exists Options.getprograminputs. This is bad in any case, but especially bad because Options are also used server side, so this has the potential to expose arbitrary code injection in runtime containers, now or at a later time. Details...
GHSA-CQ96-9974-V8HM Dynamic Variable Evaluation in qiskit-ibm-runtime
Summary An eval method exists Options.getprograminputs. This is bad in any case, but especially bad because Options are also used server side, so this has the potential to expose arbitrary code injection in runtime containers, now or at a later time. Details...
Qiskit IBM Runtime 安全漏洞
Qiskit IBM Runtime is a component of International Business Machines IBM that is used to interact with IBM Quantum hardware and simulators on the IBM Quantum Experience platform. A security vulnerability exists in Qiskit IBM Runtime version 0.1.0 through versions prior to 0.21.2, which stems from...
