Summary
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in PyTorch ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder einen unspezifischen Angriff durchzuführen.
Product
PyTorch ist eine Tensor-Bibliothek für Deep Learning mit GPUs und CPUs.
Vulnerabilities 2
-
Critical 9.8
TorchServe bypass allowed_urls configuration
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being dow…
-
High 8.2
TorchServe gRPC Port Exposure
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two in…
Revision history
-
#1
Initiale Fassung
References
-
Amazon Security Advisory vom 2024-07-22
https://aws.amazon.com/de/security/security-bulletins/AWS-2024-009/
-
PyTorch GitHub vom 2024-07-22
https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2
-
PyTorch GitHub vom 2024-07-22
https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w