PT-2025-9875 · Dgl · Dgl

Publicado 2025-03-05 · Atualizado 2025-03-05

Positive Technologies (AI Summary)

CVSS v4.0

8.9

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions DGL (affected versions not specified)

Description The issue concerns the use of pickle serialization and deserialization in the RPC server of DGL, which poses a known risk for remote code execution due to vulnerabilities in pickle deserialization functionality. When running DGL distributed training and inference, assigning public IPs to instances in the cluster may increase the risk.

Recommendations For all versions of DGL, as a temporary workaround, consider restricting access to the RPC server by not assigning public IPs to any instance in the cluster when running DGL distributed training and inference. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

GHSA-3X5X-FW77-G54C

Produtos afetados

Dgl

Referências · 4

• https://github.com/dmlc/dgl/security/advisories/GHSA-3x5x-fw77-g54c · Nota
• https://github.com/dmlc/dgl/issues/7874 · Nota
• https://github.com/dmlc/dgl · Nota
• https://osv.dev/vulnerability/GHSA-3x5x-fw77-g54c · Aviso do Fabricante