Code Injection in PyTorch Lightning
PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. A [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) is included in the `1.6.0` release.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-0845US | critical9.8 | — | ||
Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/PyTorchLightning/pytorch-lightning/pull/12212WEB
- https://github.com/advisories/GHSA-r5qj-cvf9-p85hADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yamlWEB
- https://github.com/pytorchlightning/pytorch-lightningWEB
- https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8aeWEB
- https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2aWEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-0845ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan