CVE-2024-29032CWE-502

`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

Medium · published March 20, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00372 · 30.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-03-20T20:30Z
EPSS history
Timeline
  • 20 MAR 20:30Z
    `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code
    cvelistv5