Description
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hydra-ecosystem | hydra-ray-launcher | 1.1.0.dev1 – < 1.2.2, 1.4.0.dev4 – < 1.4.0rc2 | 1.2.2 |
References
- GitHub Security Advisory (GHSA-h34c-q33w-3r7q) vendor-advisory
- https://github.com/hydra-ecosystem/hydra/pull/3566 issue-tracking patch
- https://github.com/hydra-ecosystem/hydra/commit/46e2fdaecd54dbfc041616b1229bd1614b73d765 patch
- https://pypi.org/project/hydra-ray-launcher/1.2.2/ release-notes
- VulnCheck Advisory: hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import third-party-advisory