PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-1603 · ADVISORY
• PaddlePaddle/Paddle · PACKAGE
• PaddlePaddle/Paddle · WEB
• PaddlePaddle/Paddle · WEB
• huntr.com/bounties/7739eced-73a3-4a96-afcd-9c753c55929e · WEB
• pypi.org/project/paddlepaddle · PACKAGE
• GitHub Advisory GHSA-jwrc-3v3f-5cq5 · ADVISORY

paddlepaddle のその他の脆弱性

• CVE-2024-0818緊急 9.1Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6
• CVE-2024-0917緊急 9.8remote code execution in paddlepaddle/paddle 2.6.0
• CVE-2024-0815高 8.8Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0
• CVE-2024-0817高 7.8Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0
• CVE-2024-0521高 7.8Code Injection in paddlepaddle/paddle