CVE-2021-43811: Sockeye YAML Config File Code Execution
Summary
CVE-2021-43811: Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Affects sockeye versions < 2.3.24. Fixed in 2.3.24. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. It utilizes YAML to store model and data configurations on disk. The package is commonly used for machine translation tasks and provides a convenient way to train and deploy translation models. However, versions below 2.3.24 of Sockeye suffer from a vulnerability that allows arbitrary code execution when loading unsafe YAML configurations.
Vulnerability Detail
The vulnerability in Sockeye arises from the unsafe loading of YAML configurations in versions prior to 2.3.24. An attacker can exploit this by embedding malicious code in the config file of a trained model and tricking users into downloading and running it. If the users execute the model, the embedded code will run locally on their machines. This can lead to various consequences, including unauthorized access, data leakage, or remote code execution. The issue has been addressed in version 2.3.24 of Sockeye.
How To Fix
Minimum fixed version
2.3.24
This is the first release that contains the fix.
pip install --upgrade "sockeye==2.3.24"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The vulnerability in Sockeye allows for arbitrary code execution through the loading of unsafe YAML configurations. To mitigate this risk, it is crucial to update to Sockeye version 2.3.24 or higher. Failure to do so may result in unauthorized access, data leakage, or remote code execution. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sockeye →
FAQ
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. It provides tools for training and deploying translation models.
The vulnerability allows an attacker to execute arbitrary code on a user's machine by tricking them into running a model with a malicious config file. This can lead to unauthorized access, data leakage, or remote code execution.
To fix this vulnerability, update Sockeye to version 2.3.24 or higher. Make sure to download the package from a trusted source and verify its integrity before installation.
No, only versions below 2.3.24 are affected. It is recommended to update to the latest version to ensure the vulnerability is patched.
No, there is no known workaround. Updating to the fixed version is the only solution.
