CVE-2024-12777: Aim vulnerable to Synchronous Access of Remote Resource without Timeout

March 20, 2025 (updated March 21, 2025)

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in the sshfs-client causes the server to hang for a significant amount of time, preventing it from responding to other requests.

References

github.com/advisories/GHSA-v5pj-jrpv-h6g2
github.com/aimhubio/aim
github.com/aimhubio/aim/blob/d4ad66ac87606b1f377d3e685e861abb2eef6c45/aim/ext/sshfs/utils.py
huntr.com/bounties/cdf8db79-c290-4fe5-9383-4c518bfba4a8
nvd.nist.gov/vuln/detail/CVE-2024-12777

Code Behaviors & Features

Detect and mitigate CVE-2024-12777 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →