CVE-2024-10190
CVSS 3.0 Score 9.8 of 10 (critical)
Details
Published Mar 20, 2025
CWE ID 77
Summary
CVE-2024-10190 is a remote code execution vulnerability affecting Horovod versions up to and including v0.28.1. The issue arises due to the improper handling of base64-encoded data in the `ElasticRendezvousHandler` component. More specifically, the `_put_value` method in this subclass calls `codec.loads_base64(value)`, which ultimately leads to the execution of `cloudpickle.loads(decoded)`. This means an attacker can send a malicious pickle object via a PUT request, successfully executing arbitrary code on the server without authentication.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.