CVE-2024-52524 MEDIUM

CVE-2024-52524: ReDoS in Giskard Scan text perturbation

Vendor Giskard-Ai
Product giskard
Weakness CWE-1333
Published November 14, 2024
Last update November 21, 2024

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Clear

What the vulnerability does

01Description

Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected.

Key dates

02Disclosure timeline

November 14, 2024 CVE published
November 21, 2024 Record updated