Vulnerabilitycritical
Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1471 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization | 9.8 | 100% | PoC ×3 | |
| CVE-2023-43654 | TorchServe: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests… | 9.8 | 42% | PoC |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Oct 03, 2023 Artificial Intelligence / Cyber Threat Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities ShellTorch .
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.