« Volver al listado

CVE-2024-50050

Estado: AplazadaMedia (6.3)—

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Llama Stack — Llama StackAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-50050",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-50050",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-24T18:04:11.237412Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve-assign@fb.com",
      "affectedData": [
        {
          "vendor": "Meta Platforms, Inc",
          "product": "Llama Stack",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7a8aa775e5a267cf8660d83140011a0b7f91e005",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:meta_platforms_inc:llama_stack:*:*:*:*:*:*:*:*"
          ],
          "vendor": "meta_platforms_inc",
          "product": "llama_stack",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7a8aa775e5a267cf8660d83140011a0b7f91e005",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-23T14:15:05.087",
  "references": [
    {
      "url": "https://www.facebook.com/security/advisories/cve-2024-50050",
      "source": "cve-assign@fb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead."
    },
    {
      "lang": "es",
      "value": "Antes de la revisión 7a8aa775e5a267cf8660d83140011a0b7f91e005, Llama Stack utilizaba pickle como formato de serialización para la comunicación por socket, lo que potencialmente permitía la ejecución remota de código. La comunicación por socket se modificó para utilizar JSON en su lugar."
    }
  ],
  "lastModified": "2026-06-17T08:03:27.843",
  "sourceIdentifier": "cve-assign@fb.com"
}