PT-2024-16957 · Hugging Face · Huggingface/Transformers

🗓️ 19 Nov 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 4 Views

Hugging Face Transformers remote code execution via deserialization of untrusted model files; user interaction required.

Reporter	Title	Published	Views	Family All 29
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has vulnerabilities due to transformers package (CVE-2024-11392, CVE-2024-11393, CVE-2024-11394)	17 Jul 202518:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.46.3-py3-none-any.whl CVE-2024-12720	13 May 202507:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	8 May 202523:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to Remote Code Execution in Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]	30 May 202515:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.	9 May 202509:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in Hugging Face Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]	2 Apr 202517:21	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in Python wheel package for the Hugging Face Transformers library affecting watsonx Code Assistant On Prem Extensions	27 Mar 202515:39	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Huggingface Transformers	7 Dec 202411:25	–	githubexploit
Chainguard	CVE-2024-11394 vulnerabilities	22 Nov 202422:15	–	cgr
Circl	CVE-2024-11394	19 Nov 202406:00	–	circl

Source	Link
osv	www.osv.dev/vulnerability/GHSA-hxxf-235m-72v3
osv	www.osv.dev/vulnerability/PYSEC-2024-229
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-1515
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-11394
osv	www.osv.dev/vulnerability/CVE-2024-11394
github	www.github.com/huggingface/transformers
github	www.github.com/huggingface/transformers/issues/34840
github	www.github.com/huggingface/transformers/pull/35296
github	www.github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-229.yaml
twitter	www.twitter.com/dailycve/status/1862209471516197034

28 Nov 2024 00:00Current

9.1High risk

Vulners AI Score9.1

CVSS 3.18.8

CVSS 38.8

EPSS0.65048

SSVC