En resumen
- CVE-2024-34997 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a joblib, joblib (joblib project).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.66%, mayor que el 52.0% de las vulnerabilidades.
- Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.
| Package | Affected versions | Patched versions |
|---|
| joblib PyPI | ≤ 1.4.2
| No fix yet |
| joblib | = 1.4.2
| No fix yet |
Description
joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.
NVD description
joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free