Unauthenticated Denial of Service via ast.literal_eval
An unauthenticated Denial of Service (DoS) vulnerability was discovered in the litellm server, affecting version git 26c03c9. The issue arises from the use of ast.literal_eval to parse user input, which can be exploited to crash the server. The vulnerability has not yet been patched.
Available publicly on Nov 28 2024
Remediation Steps
- Avoid using ast.literal_eval to parse user input, especially from unauthenticated users.
- Implement proper input validation and sanitization to ensure that only safe data is processed.
- Consider using safer alternatives for parsing user input, such as json.loads for JSON data.
- Apply patches or updates once they are available from the maintainers of litellm.
- Monitor server logs for unusual activity and potential exploitation attempts.
Patch Details
- Fixed Version: N/A
- Patch Commit: N/A
Want more out of Sightline?
Sightline offers even more for premium customers
Go Premium
We have - related security advisories that are available with Sightline Premium.