PT-2019-12048 · Sony · Sony Neural Network Libraries

Publicado 2019-04-04 · Atualizado 2022-05-13 · CVE-2019-10844

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sony Neural Network Libraries (aka nnabla) versions prior to 1.0.14

Description The issue arises from the reliance on the HOME environment variable, which might be untrusted, in the nbla/logger.cpp file within libnnabla.a. This could potentially lead to security issues due to the variable's untrusted nature.

Recommendations For versions prior to 1.0.14, update to version 1.0.14 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-807

Identificadores relacionados

CVE-2019-10844

GHSA-4Q2W-RW7M-XQW6

PYSEC-2019-107

Produtos afetados

Sony Neural Network Libraries

Referências · 11

• https://github.com/sony/nnabla/issues/209 · Correção
• https://github.com/sony/nnabla/pull/299 · Nota
• https://github.com/sony/nnabla/releases/tag/v1.0.10 · Nota
• https://github.com/sony/nnabla · Nota
• https://github.com/sony/nnabla/commit/e87347648ab7210529a0e60f0849680de8e9b63a · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/nnabla/PYSEC-2019-107.yaml · Nota
• https://osv.dev/vulnerability/GHSA-4q2w-rw7m-xqw6 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-107 · Aviso do Fabricante
• https://github.com/advisories/GHSA-4q2w-rw7m-xqw6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10844 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10844 · Aviso do Fabricante