Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl: 4 vulnerabilities (highest severity is: 9.8) #134

Open
mend-bolt-for-github bot opened this issue Sep 18, 2024 · 0 comments
Open

torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl: 4 vulnerabilities (highest severity is: 9.8) #134

mend-bolt-for-github bot opened this issue Sep 18, 2024 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-bolt-for-github
Copy link
Contributor

mend-bolt-for-github bot commented Sep 18, 2024 •
edited
Loading

Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /embedding/requirements.txt

Path to vulnerable library: /embedding/requirements.txt

Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (torch version) Remediation Possible**
CVE-2024-48063 Critical 9.8 torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl Direct 2.5.0 ❌
CVE-2024-31584 High 7.5 torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl Direct 2.2.0 ❌
CVE-2024-31583 High 7.5 torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl Direct 2.2.0 ❌
CVE-2024-31580 High 7.5 torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl Direct 2.2.0 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-48063

Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /embedding/requirements.txt

Path to vulnerable library: /embedding/requirements.txt

Dependency Hierarchy:

  • ❌ torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f

Found in base branch: main

Vulnerability Details

In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.

Publish Date: 2024-10-29

URL: CVE-2024-48063

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-48063

Release Date: 2024-10-29

Fix Resolution: 2.5.0

Step up your Open Source Security Game with Mend here

CVE-2024-31584

Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /embedding/requirements.txt

Path to vulnerable library: /embedding/requirements.txt

Dependency Hierarchy:

  • ❌ torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f

Found in base branch: main

Vulnerability Details

Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.

Publish Date: 2024-04-19

URL: CVE-2024-31584

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-31584

Release Date: 2024-04-19

Fix Resolution: 2.2.0

Step up your Open Source Security Game with Mend here

CVE-2024-31583

Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /embedding/requirements.txt

Path to vulnerable library: /embedding/requirements.txt

Dependency Hierarchy:

  • ❌ torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f

Found in base branch: main

Vulnerability Details

Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.

Publish Date: 2024-04-17

URL: CVE-2024-31583

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-31583

Release Date: 2024-04-17

Fix Resolution: 2.2.0

Step up your Open Source Security Game with Mend here

CVE-2024-31580

Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /embedding/requirements.txt

Path to vulnerable library: /embedding/requirements.txt

Dependency Hierarchy:

  • ❌ torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f

Found in base branch: main

Vulnerability Details

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Publish Date: 2024-04-17

URL: CVE-2024-31580

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-31580

Release Date: 2024-04-17

Fix Resolution: 2.2.0

Step up your Open Source Security Game with Mend here
@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Sep 18, 2024
@mend-bolt-for-github mend-bolt-for-github bot changed the title torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl: 4 vulnerabilities (highest severity is: 7.5) torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl: 3 vulnerabilities (highest severity is: 7.5) Oct 8, 2024
@mend-bolt-for-github mend-bolt-for-github bot changed the title torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl: 3 vulnerabilities (highest severity is: 7.5) torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl: 4 vulnerabilities (highest severity is: 9.8) Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants