GHSA-36h2-g4c8-9xcm

Aim denial of service vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-6227

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	aim	<= 3.19.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-6227 advisory
https://github.com/aimhubio/aim package
https://github.com/aimhubio/aim/blob/2e7b8aff8dcba9ddd5043dfec88cf2319ba8a87c/aim/sdk/repo.py#L195 web
https://huntr.com/bounties/abcea7c6-bb3b-45e9-aa15-9eb6b224451a web