Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.

🗓️ 26 Feb 2024 08:00:00Reported by MicrosoftType

ONNX versions before and including 1.15.0 allow directory traversal via external_data in tensor proto, bypassing the 2022 patch.

Reporter	Title	Published	Views	Family All 63
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data Are Addressed	8 Dec 202311:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to path traversal in onnx [CVE-2024-27318]	1 Aug 202416:21	–	ibm
IBM Security Bulletins	Security Bulletin: Several vulnerabilities affect Watson Machine Learning Accelerator on Cloud Pak for Data 5.0.0	29 Apr 202502:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data Are Addressed	28 Aug 202509:51	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties in Open Source packages affecting IBM Watson Machine Learning Accelerator on Cloud Pak for Data	12 Dec 202317:35	–	ibm
Tenable Nessus	Azure Linux 3.0 Security Update: pytorch (CVE-2024-27318)	10 Feb 202500:00	–	nessus
Tenable Nessus	Fedora 39 : onnx (2024-270e3b5e9b)	28 Mar 202400:00	–	nessus
Tenable Nessus	Fedora 40 : onnx (2024-abe1e34fdb)	29 Apr 202400:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: pytorch (CVE-2024-27318)	3 Jul 202400:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: pytorch (CVE-2022-25882)	20 Apr 202300:00	–	nessus