CVE-2022-0845: Code Injection in pytorch-lightning
Summary
CVE-2022-0845: Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0. Affects pytorch-lightning across 2 version ranges.
< 1.6.0
< 8b7a12c52e52a06408e9231647839ddb4665e8ae
Fixed in 8b7a12c52e52a06408e9231647839ddb4665e8ae. How to fix ↓
Also tracked for
- lightning · PyPI
The same CVE-2022-0845 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pytorch-lightning is a PyTorch wrapper that provides a high-level interface for training and organizing deep learning models. It simplifies the process of building and training models by abstracting away the low-level details. This vulnerability affects versions prior to 1.6.0 of pytorch-lightning.
Vulnerability Detail
The vulnerability in pytorch-lightning prior to version 1.6.0 allows for code injection. An attacker can exploit this vulnerability to execute arbitrary code within the context of the application. This can lead to unauthorized access, data leakage, or remote code execution, depending on the privileges of the application. The vulnerability originates from improper input validation and sanitization of user-supplied data.
How To Fix
Minimum fixed version
8b7a12c52e52a06408e9231647839ddb4665e8ae
This is the first release that contains the fix.
pip install --upgrade "pytorch-lightning==8b7a12c52e52a06408e9231647839ddb4665e8ae"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version as soon as possible.
Conclusion
In conclusion, the vulnerability in pytorch-lightning prior to version 1.6.0 allows for code injection, which can have severe consequences. It is crucial to upgrade to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pytorch-lightning →
FAQ
pytorch-lightning is a PyTorch wrapper that simplifies the process of building and training deep learning models.
This vulnerability allows for code injection, which can lead to unauthorized access, data leakage, or remote code execution.
You can fix this vulnerability by upgrading pytorch-lightning to version 1.6.0 or later.
No, there is no known workaround. It is essential to upgrade to the fixed version.
You can find more information about this vulnerability in the advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pytorch-lightning/PYSEC-2022-181.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for pytorch-lightning.
