PT-2025-9875 · Dgl · Dgl

Published 2025-03-05 · Updated 2025-03-05

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions DGL (affected versions not specified)

Description The issue concerns the use of pickle serialization and deserialization in the RPC server of DGL, which poses a known risk for remote code execution due to vulnerabilities in pickle deserialization functionality. When running DGL distributed training and inference, assigning public IPs to instances in the cluster may increase the risk.

Recommendations For all versions of DGL, as a temporary workaround, consider restricting access to the RPC server by not assigning public IPs to any instance in the cluster when running DGL distributed training and inference. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

GHSA-3X5X-FW77-G54C

Affected Products

Dgl

References · 4

• https://osv.dev/vulnerability/GHSA-3x5x-fw77-g54c · Vendor Advisory
• https://github.com/dmlc/dgl/security/advisories/GHSA-3x5x-fw77-g54c · Note
• https://github.com/dmlc/dgl/issues/7874 · Note
• https://github.com/dmlc/dgl · Note