8.2 CVE-2024-35199
Enriched by CISA Patch
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
https://nvd.nist.gov/vuln/detail/CVE-2024-35199
Categories
CWE-668 : Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
References
af854a3a-2127-422b-91ae-364da2661108 Patch
| https://github.com/pytorch/serve/pull/3083 Patch |
| https://github.com/pytorch/serve/releases/tag/v0.11.0 Release Notes |
| https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w Patch Third Party Advisory |
security-advisories@github.com Patch
| https://github.com/pytorch/serve/pull/3083 Patch |
| https://github.com/pytorch/serve/releases/tag/v0.11.0 Release Notes |
| https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w Patch Third Party Advisory |
AFFECTED (from MITRE)
| Vendor | Product | Versions |
|---|---|---|
| pytorch | serve |
|
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. | ||
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:* | >= 0.3.0 | < 0.11.0 |
REMEDIATION
Patch
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| No entry | ||
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
