PT-2019-12048 · Sony · Sony Neural Network Libraries

Published 2019-04-04 · Updated 2022-05-13 · CVE-2019-10844

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sony Neural Network Libraries (aka nnabla) versions prior to 1.0.14

Description The issue arises from the reliance on the HOME environment variable, which might be untrusted, in the nbla/logger.cpp file within libnnabla.a. This could potentially lead to security issues due to the variable's untrusted nature.

Recommendations For versions prior to 1.0.14, update to version 1.0.14 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2019-10844

GHSA-4Q2W-RW7M-XQW6

PYSEC-2019-107

Affected Products

Sony Neural Network Libraries

References · 11

• https://github.com/sony/nnabla/issues/209 · Patch
• https://osv.dev/vulnerability/GHSA-4q2w-rw7m-xqw6 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10844 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10844 · Vendor Advisory
• https://github.com/sony/nnabla/pull/299 · Note
• https://github.com/sony/nnabla/releases/tag/v1.0.10 · Note
• https://github.com/sony/nnabla · Note
• https://github.com/sony/nnabla/commit/e87347648ab7210529a0e60f0849680de8e9b63a · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nnabla/PYSEC-2019-107.yaml · Note
• https://github.com/advisories/GHSA-4q2w-rw7m-xqw6 · Note