search

KOSASIH / mmsegmentation

OpenMMLab Semantic Segmentation Toolbox and Benchmark.
https://mmsegmentation.readthedocs.io/en/latest/
Apache License 2.0
1 stars 0 forks source link

clip-1.0.zip: 5 vulnerabilities (highest severity is: 9.8) #10

Open mend-bolt-for-github[bot] opened 6 months ago

mend-bolt-for-github[bot] commented 6 months ago
Vulnerable Library - clip-1.0.zip

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 8e387a7262658283897e667cd3516ab139260eea

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (clip version) Remediation Possible**
CVE-2024-48063 Critical 9.8 torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl Transitive N/A* ❌
CVE-2024-31584 High 7.5 torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl Transitive N/A* ❌
CVE-2024-31583 High 7.5 torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl Transitive N/A* ❌
CVE-2024-31580 High 7.5 torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl Transitive N/A* ❌
CVE-2024-34062 Medium 4.8 tqdm-4.66.1-py3-none-any.whl Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-48063 ### Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - clip-1.0.zip (Root Library) - :x: **torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl** (Vulnerable Library)

Found in HEAD commit: 8e387a7262658283897e667cd3516ab139260eea

Found in base branch: main

### Vulnerability Details

In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.

Publish Date: 2024-10-29

URL: CVE-2024-48063

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-48063

Release Date: 2024-10-29

Fix Resolution: torch - 2.5.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-31584 ### Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - clip-1.0.zip (Root Library) - :x: **torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl** (Vulnerable Library)

Found in HEAD commit: 8e387a7262658283897e667cd3516ab139260eea

Found in base branch: main

### Vulnerability Details

Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.

Publish Date: 2024-04-19

URL: CVE-2024-31584

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-31584

Release Date: 2024-04-19

Fix Resolution: torch - 2.2.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-31583 ### Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - clip-1.0.zip (Root Library) - :x: **torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl** (Vulnerable Library)

Found in HEAD commit: 8e387a7262658283897e667cd3516ab139260eea

Found in base branch: main

### Vulnerability Details

Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.

Publish Date: 2024-04-17

URL: CVE-2024-31583

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-31583

Release Date: 2024-04-17

Fix Resolution: torch - 2.2.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-31580 ### Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - clip-1.0.zip (Root Library) - :x: **torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl** (Vulnerable Library)

Found in HEAD commit: 8e387a7262658283897e667cd3516ab139260eea

Found in base branch: main

### Vulnerability Details

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Publish Date: 2024-04-17

URL: CVE-2024-31580

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-31580

Release Date: 2024-04-17

Fix Resolution: torch - 2.2.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-34062 ### Vulnerable Library - tqdm-4.66.1-py3-none-any.whl

Fast, Extensible Progress Meter

Library home page: https://files.pythonhosted.org/packages/00/e5/f12a80907d0884e6dff9c16d0c0114d81b8cd07dc3ae54c5e962cc83037e/tqdm-4.66.1-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - clip-1.0.zip (Root Library) - :x: **tqdm-4.66.1-py3-none-any.whl** (Vulnerable Library)

Found in HEAD commit: 8e387a7262658283897e667cd3516ab139260eea

Found in base branch: main

### Vulnerability Details

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-05-03

URL: CVE-2024-34062

### CVSS 3 Score Details (4.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p

Release Date: 2024-05-03

Fix Resolution: tqdm - 4.66.3

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)