CVE-2021-4118: pytorch-lightning - Deserialization of Untrusted Data
Summary
CVE-2021-4118: pytorch-lightning is vulnerable to Deserialization of Untrusted Data. Affects pytorch-lightning across 2 version ranges.
< 1.6.0
< 62f1e82e032eb16565e676d39e0db0cac7e34ace
Fixed in 62f1e82e032eb16565e676d39e0db0cac7e34ace. How to fix ↓
Also tracked for
- lightning · PyPI
The same CVE-2021-4118 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pytorch-lightning is a PyTorch wrapper that provides a high-level interface for training and organizing deep learning models. It simplifies the process of implementing complex training loops and supports various features such as distributed training, automatic checkpointing, and logging. However, pytorch-lightning versions prior to 1.6.0 are vulnerable to a deserialization of untrusted data issue.
Vulnerability Detail
The vulnerability in pytorch-lightning arises from a lack of proper input validation when deserializing data. An attacker can exploit this by providing maliciously crafted serialized data, leading to arbitrary code execution. This can result in unauthorized access, data leakage, or the execution of arbitrary commands on the affected system. The vulnerability affects all versions of pytorch-lightning prior to 1.6.0.
How To Fix
Minimum fixed version
62f1e82e032eb16565e676d39e0db0cac7e34ace
This is the first release that contains the fix.
pip install --upgrade "pytorch-lightning==62f1e82e032eb16565e676d39e0db0cac7e34ace"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
pytorch-lightning versions prior to 1.6.0 are vulnerable to a deserialization of untrusted data issue. To mitigate this vulnerability, it is crucial to update pytorch-lightning to version 1.6.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pytorch-lightning →
FAQ
pytorch-lightning is a PyTorch wrapper that simplifies the process of training and organizing deep learning models. It provides a high-level interface and supports various features such as distributed training and automatic checkpointing.
The vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data leakage, or the execution of malicious commands.
All versions of pytorch-lightning prior to 1.6.0 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to update to pytorch-lightning 1.6.0 or later.
You can update pytorch-lightning by running the command 'pip install --upgrade pytorch-lightning'. Make sure to specify the desired version, such as 1.6.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for pytorch-lightning.
