Skip to content
OpenAdvisories
High WID-SEC-2025-0623 4 CVEs

PyTorch: Mehrere Schwachstellen

Published Mar 23, 2025 · Updated Mar 23, 2025 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PyTorch ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen preiszugeben, beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu verursachen.

Product

PyTorch ist eine Tensor-Bibliothek für Deep Learning mit GPUs und CPUs.

Vulnerabilities 4

  • Critical 9.1
    CVE-2024-8019

    Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning

    In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by provid…

    Lightning-AI lightning-ai/pytorch-lightning lightning pytorch-lightning PyPI
  • High 7.5
    CVE-2024-8020

    Denial of Service in lightning-ai/pytorch-lightning

    A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected s…

    Lightning-AI lightning-ai/pytorch-lightning lightning pytorch-lightning PyPI
  • Medium 6.3
    CVE-2024-6577

    Unclaimed S3 Bucket Usage in pytorch/serve

    In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthori…

    pytorch pytorch/serve torchserve PyPI
  • Unscored —
    CVE-2024-7804 Public exploit Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Revision history

  1. #1

    Initiale Fassung

References