torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl: 5 vulnerabilities (highest severity is: 7.5) #134
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-bolt-for-github
bot
added
the
Mend: dependency security vulnerability
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Tensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /embedding/requirements.txt
Path to vulnerable library: /embedding/requirements.txt
Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Tensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /embedding/requirements.txt
Path to vulnerable library: /embedding/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f
Found in base branch: main
Vulnerability Details
Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.
Publish Date: 2024-04-19
URL: CVE-2024-31584
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-31584
Release Date: 2024-04-19
Fix Resolution: 2.2.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Tensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /embedding/requirements.txt
Path to vulnerable library: /embedding/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f
Found in base branch: main
Vulnerability Details
Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.
Publish Date: 2024-04-17
URL: CVE-2024-31583
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-31583
Release Date: 2024-04-17
Fix Resolution: 2.2.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Tensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /embedding/requirements.txt
Path to vulnerable library: /embedding/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f
Found in base branch: main
Vulnerability Details
PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Publish Date: 2024-04-17
URL: CVE-2024-31580
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-31580
Release Date: 2024-04-17
Fix Resolution: 2.2.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Tensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /embedding/requirements.txt
Path to vulnerable library: /embedding/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f
Found in base branch: main
Vulnerability Details
A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.
Publish Date: 2025-03-10
URL: CVE-2025-2148
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with Mend here
Vulnerable Library - torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Tensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/00/86/77a9eddbf46f1bca2468d16a401911f58917f95b63402d6a7a4522521e5d/torch-1.13.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /embedding/requirements.txt
Path to vulnerable library: /embedding/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: f548525baaf6d16b6a6edc667027ce1b0516e50f
Found in base branch: main
Vulnerability Details
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Publish Date: 2025-03-10
URL: CVE-2025-2149
CVSS 3 Score Details (2.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: