PT-2024-5048 · Unknown · Deepjavalibrary

Tosterberg · Published 2024-05-16 · Updated 2024-07-08 · CVE-2024-37902

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: DeepJavaLibrary(DJL) versions 0.1.0 through 0.27.0

Description: The issue is related to the incorrect restriction of the directory path name with limited access. This can allow a remote attacker to overwrite system files. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations: For DeepJavaLibrary(DJL) versions 0.1.0 through 0.27.0, users are advised to upgrade to version 0.28.0 or apply the patch in DJL Large Model Inference containers version 0.27.0. As a temporary workaround, consider restricting the use of absolute path archived artifacts to prevent them from inserting archived files directly into the system.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-05575

CVE-2024-37902

GHSA-W877-JFW7-46RJ

Affected Products

Deepjavalibrary

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37902.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37902 · Security Note
• https://bdu.fstec.ru/vul/2024-05575 · Security Note
• https://osv.dev/vulnerability/GHSA-w877-jfw7-46rj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37902 · Vendor Advisory
• https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0 · Note
• https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj · Note
• https://github.com/deepjavalibrary/djl · Note
• https://github.com/aws/deep-learning-containers/releases/tag/v1.4-djl-0.27.0-inf-trt-0.8.0 · Note
• https://github.com/aws/deep-learning-containers/releases/tag/v1.4-djl-0.27.0-inf-ds-0.12.6 · Note
• https://github.com/aws/deep-learning-containers/releases/tag/v1.1-djl-0.27.0-inf-cpu-full · Note
• https://github.com/aws/deep-learning-containers/releases/tag/v1.3-djl-0.27.0-inf-neuronx-sdk2.18.1 · Note
• https://twitter.com/cracbot/status/1804393938796843011 · Twitter Post
• https://github.com/advisories/GHSA-w877-jfw7-46rj · Note
• https://twitter.com/Komodosec/status/1810374690009133245 · Twitter Post