CVE-2024-7010 Timing Attack in mudler/localai
An attacker can determine valid login credentials by analyzing server response times, leading to unauthorized access to the LocalAI server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7010?
CVE-2024-7010 is a high-severity vulnerability in mudler/localai, published on 29 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid login credentials based on the server's response time, potentially leading to unauthorized access.
Which versions are affected by CVE-2024-7010?
It affects 1 product.
Products include Mudler Localai.
How do I fix CVE-2024-7010?
No fix has been published for CVE-2024-7010 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-7010 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-7010 exists.
Other vulnerabilities in mudler/localai
Sources
Also known as GHSA-9hcm-hr65-2825.