PT-2021-23951 · Sockeye · Sockeye

Masatoshi Yoshizawa · Published 2021-12-08 · Updated 2022-08-22 · CVE-2021-43811

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Sockeye versions prior to 2.3.24

Description: Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. It uses YAML to store model and data configurations on disk. The issue arises from unsafe YAML loading in versions below 2.3.24, which can execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally.

Recommendations: For versions prior to 2.3.24, update to version 2.3.24 or above to fix the issue. As a temporary workaround, consider avoiding the use of config files from untrusted sources and restricting the execution of models with potentially malicious config files.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-43811

GHSA-GGMR-44CV-24PM

PYSEC-2021-848

Affected Products

Sockeye

References · 12

• 🔥 https://github.com/s-index/CVE-2021-43811 · Exploit
• https://github.com/awslabs/sockeye/pull/964 · Patch
• https://osv.dev/vulnerability/GHSA-ggmr-44cv-24pm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43811 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43811 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-848 · Vendor Advisory
• https://github.com/awslabs/sockeye/releases/tag/2.3.24 · Note
• https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pm · Note
• https://github.com/awslabs/sockeye · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/sockeye/PYSEC-2021-848.yaml · Note
• https://t.me/cibsecurity/33667 · Telegram Post
• https://t.me/cybersecuritytechnologies/6646 · Telegram Post