| Package | Affected versions | Patched versions |
|---|---|---|
| horovod | ≤ 0.28.1 | |
| horovod | ≤ 0.28.1 |
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandler. Specifically, the _put_value method in ElasticRendezvousHandler calls codec.loads_base64(value), which eventually invokes cloudpickle.loads(decoded). This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free