Code Injection in PyTorch Lightning
PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. A [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) is included in the `1.6.0` release.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-0845US | critical9.8 | — | ||
Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/PyTorchLightning/pytorch-lightning/pull/12212WEB
- https://github.com/advisories/GHSA-r5qj-cvf9-p85hADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yamlWEB
- https://github.com/pytorchlightning/pytorch-lightningWEB
- https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8aeWEB
- https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2aWEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-0845ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan