PT-2024-21817 · Onnx · Onnx

Published 2024-02-23 · Updated 2025-01-22 · CVE-2024-27318

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions onnx versions prior to 1.15.0

Description The issue allows Directory Traversal as the external data field of the tensor proto can have a path to a file outside the model's current directory or user-provided directory. This vulnerability occurs as a bypass for a previously added patch.

Recommendations For versions prior to 1.15.0, update to a version later than 1.15.0 to resolve the issue. As a temporary workaround, consider restricting access to the external data field of the tensor proto to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-34464

AZL-35146

CVE-2024-27318

GHSA-WHH8-FJGC-QP73

OPENSUSE-SU-2024:13803-1

PYSEC-2024-222

Affected Products

Onnx

References · 19

• https://github.com/onnx/onnx/commit/66b7fb630903fdcf3e83b6b6d56d82e904264a20 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-222 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27318 · Security Note
• https://osv.dev/vulnerability/GHSA-whh8-fjgc-qp73 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34464 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35146 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27318 · Vendor Advisory
• https://github.com/onnx/onnx · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2024-222.yaml · Note
• https://t.me/cvenotify/108201 · Telegram Post
• https://twitter.com/cracbot/status/1761610614735024610 · Twitter Post
• https://t.me/cvenotify/72312 · Telegram Post
• https://t.me/cvenotify/75189 · Telegram Post