CVE-2022-0845: Code Injection in PyTorch Lightning
Summary
CVE-2022-0845: Code Injection in PyTorch Lightning. Affects pytorch-lightning versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Also tracked for
- lightning · PyPI
The same CVE-2022-0845 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyTorch Lightning is an open-source Python library that provides a high-level interface for PyTorch, simplifying the process of training and testing deep learning models. It offers various features and utilities to enhance the development and deployment of PyTorch-based projects. However, PyTorch Lightning versions 1.5.10 and prior are vulnerable to code injection.
Vulnerability Detail
The vulnerability in PyTorch Lightning allows an attacker to execute arbitrary commands on the target operating system by manipulating the PL_TRAINER_GPUS environment variable when using the Trainer module. By exploiting this vulnerability, an attacker can gain unauthorized access and perform malicious actions on the system. The vulnerability has a CVSS score of 9.8 (Critical) and is classified under CWE-94 (Code Injection).
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
pip install --upgrade "pytorch-lightning==1.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version of PyTorch Lightning to mitigate the risk of code injection.
Conclusion
PyTorch Lightning versions 1.5.10 and prior are vulnerable to code injection, which allows attackers to execute arbitrary commands on the target operating system. To mitigate this risk, it is crucial to update to PyTorch Lightning version 1.6.0 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pytorch-lightning →
FAQ
PyTorch Lightning is an open-source Python library that provides a high-level interface for PyTorch, simplifying the process of training and testing deep learning models.
This vulnerability allows an attacker to execute arbitrary commands on the target operating system, potentially leading to unauthorized access and malicious actions.
To fix this vulnerability, update PyTorch Lightning to version 1.6.0 or later.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
The CVSS score of this vulnerability is 9.8 (Critical).
References
Related vulnerabilities
Recent vulnerabilities recorded for pytorch-lightning.
