PT-2022-13468 · Pypi · Pytorch-Lightning

Published 2022-03-05 · Updated 2024-10-09 · CVE-2022-0845

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PyTorch Lightning versions prior to 1.6.0

Description The issue allows for code injection, potentially enabling an attacker to execute commands on the target operating system. This can be achieved by setting the PL TRAINER GPUS variable when using the Trainer module.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 to resolve the issue. As a temporary workaround, consider restricting the use of the Trainer module or avoiding the setting of the PL TRAINER GPUS variable until the update is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-0845

GHSA-R5QJ-CVF9-P85H

PYSEC-2022-181

Affected Products

Pytorch-Lightning

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0845.json · Exploit
• 🔥 https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a · Exploit
• https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0845 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0845 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-181 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5qj-cvf9-p85h · Vendor Advisory
• https://github.com/PyTorchLightning/pytorch-lightning/pull/12212 · Note
• https://github.com/pytorchlightning/pytorch-lightning · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yaml · Note
• https://t.me/cvenotify/28069 · Telegram Post
• https://github.com/advisories/GHSA-r5qj-cvf9-p85h · Note
• https://t.me/cvenotify/27797 · Telegram Post
• https://t.me/cvenotify/97589 · Telegram Post