Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-2965
CVE-2024-2965:
Python vulnerability analysis and mitigation
Overview
A Denial-of-Service (DoS) vulnerability exists in the SitemapLoader class of the langchain-ai/langchain repository (CVE-2024-2965), affecting all versions prior to 0.2.5. The vulnerability was discovered and disclosed on June 6, 2024. The parse_sitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself (NVD).
Technical details
The vulnerability stems from the parse_sitemap method's implementation, which lacks proper depth control mechanisms. When processing sitemap URLs, the method can enter an infinite recursive loop if a sitemap references itself, leading to exceeding the maximum recursion depth in Python. The vulnerability has been assigned a CVSS v3.1 base score of 4.7 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).
Impact
When exploited, this vulnerability can lead to a Denial-of-Service condition by occupying server socket/port resources and ultimately causing the Python process to crash. This impacts the availability of services that rely on the SitemapLoader functionality (NVD).
Mitigation and workarounds
A fix has been implemented that restricts the depth to which the sitemap can be parsed. The patch introduces a depth parameter and maximum depth check in the parse_sitemap method. Users should upgrade to version 0.2.5 or later to address this vulnerability (Github Commit).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management