Description
Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Qiskit SDK | 0.45.0 – ≤ 1.2.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | qiskit | >= 0.45.0, < 1.3.0 | 1.3.0 | GHSA-fpmr-m242-xm7x |
| PyPI | qiskit-terra | >= 0.45.0, <= 0.46.3 | — | GHSA-fpmr-m242-xm7x |
References
- https://www.ibm.com/support/pages/node/7183868 vendor-advisory patch