PT-2024-4342 · Liboqs +1 · Liboqs +1

Name of the Vulnerable Software and Affected Versions: liboqs versions prior to 0.10.1 Description: A control-flow timing issue has been identified in the reference implementation of the Kyber key encapsulation mechanism in liboqs, a C-language cryptographic library that provides implementations ...

CVE-2024-37880

The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a timing side channel that allows attackers to recover an ML-KEM 512 secret key in minutes. This occurs because polyfrommsg in poly.c does not prevent Clang from...

h2o-wave-ml (>=0.3.0, <=0.5.0), insolver (>=0.4.5, <=0.4.15) +2 more potentially affected by CVE-2024-5550 via h2o (>=3.18.0.8, <=3.32.0.3)

h2o PYPI version =3.18.0.8, =0.3.0, =0.4.5, =0.0.1, =0.0.102 - tsanalysis 0.1.0 Source cves: CVE-2024-5550 Source advisory: OSV:GHSA-X234-R5FG-X52M...

h2o-wave-ml (>=0.3.0, <=0.5.0), insolver (>=0.4.5, <=0.4.15) +2 more potentially affected by CVE-2024-5550 via h2o (>=3.18.0.8, <=3.32.0.3)

h2o PYPI version =3.18.0.8, =0.3.0, =0.4.5, =0.0.1, =0.0.102 - tsanalysis 0.1.0 Source cves: CVE-2024-5550 Source advisory: GHSA-X234-R5FG-X52M...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-3099 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-3099 Source advisory: OSV:GHSA-8F8Q-Q2J7-7J2M...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2024-3099 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2024-3099 Source advisory: OSV:GHSA-8F8Q-Q2J7-7J2M...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2024-2928 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2024-2928 Source advisory: OSV:GHSA-J46Q-5PXX-8VMW...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-2928 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-2928 Source advisory: OSV:GHSA-J46Q-5PXX-8VMW...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-0520 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-0520 Source advisory: OSV:GHSA-5Q6C-FFVG-XCM9...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2024-0520 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2024-0520 Source advisory: OSV:GHSA-5Q6C-FFVG-XCM9...

auto-dl (0.1.1), auto-ml (>=2.8.0, <=2.8.1) +42 more potentially affected by CVE-2024-5206 via scikit-learn (0.19.1)

scikit-learn PYPI version 0.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - auto-dl 0.1.1 - auto-ml =2.8.0, =1.0.72, =0.1.57, =0.1.19008.12a1, =0.2.0, =0.10.0, =1.1.5, =0.0.12, =0.0.6b0, =0.0.5, =0.2.0, =0.4.0 -...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-2928 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-2928 Source advisory: OSV:PYSEC-2024-242...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2024-2928 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2024-2928 Source advisory: OSV:PYSEC-2024-242...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-0520 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-0520 Source advisory: OSV:PYSEC-2024-239...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2024-0520 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2024-0520 Source advisory: OSV:PYSEC-2024-239...

curd (0.0.2), idfx (>=0.5.0, <=0.5.4) +10 more potentially affected by CVE-2024-36039 via pymysql (0.7.11)

pymysql PYPI version 0.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on pymysql and may be impacted: - curd 0.0.2 - idfx =0.5.0, =1.1.1, =0.3.18.1, =0.6.14, =1.0.5, =1.0.0, =0.0.1, =0.0.16, =0.1.0, =1.1.3, =1.1.5 Source cves: CVE-2024-36039 Source...

Vger - An Interactive CLI Application For Interacting With Authenticated Jupyter Instances

V'ger is an interactive command-line application for post-exploitation of authenticated Jupyter instances with a focus on AI/ML security operations. User Stories As a Red Teamer , you've found Jupyter credentials, but don't know what you can do with them. V'ger is organized in a format that shoul...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-4263 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2024-4263 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-3848 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-3848 Source advisory: OSV:PYSEC-2024-244...