CVE-2024-45855

Advisory

MindsDB affected versions contain a critical vulnerability in the 'finetune' function of 'inhouse' models. This flaw allows attackers to execute arbitrary code on the server by exploiting unsafe deserialization of untrusted data. Malicious actors can upload a specially crafted 'inhouse' model, which, when finetuned, triggers the execution of arbitrary code. This vulnerability poses a significant security risk, potentially leading to unauthorized access, data breaches, or complete system compromise. Users should exercise extreme caution when finetuning 'inhouse' models and ensure they only use trusted and verified models until a patch is available.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-fr9q-rgwq-g5r5
• https://github.com/mindsdb/mindsdb/blob/v24.9.2.1/mindsdb/integrations/handlers/byom_handler/byom_handler.py#L433-L442
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45855