Code Injection in PyTorch Lightning

PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the PLTRAINERGPUS when using the Trainer module. A patch is included in the 1.6.0 release...

databalancer (>=0.0.7, <=0.0.8), torchline (>=0.3.0.0a0, <=0.3.0.1) potentially affected by CVE-2022-0845 via pytorch-lightning (0.7.5)

pytorch-lightning PYPI version 0.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - databalancer =0.0.7, =0.3.0.0a0, =0.3.0.1 Source cves: CVE-2022-0845 Source advisory: OSV:GHSA-R5QJ-CVF9-P85H...

torchline (>=0.1.0, <=0.1.4.2) potentially affected by CVE-2022-0845 via pytorch-lightning (0.5.3.2)

pytorch-lightning PYPI version 0.5.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - torchline =0.1.0, =0.1.4.2 Source cves: CVE-2022-0845 Source advisory: OSV:GHSA-R5QJ-CVF9-P85H...

CVE-2022-0845

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

CVE-2022-0845

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

PYSEC-2022-181

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

baal (1.2.1), dpm360-lightsaber (>=0.2.0, <=0.2.5) +7 more potentially affected by CVE-2022-0845 via pytorch-lightning (0.8.5)

pytorch-lightning PYPI version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - baal 1.2.1 - dpm360-lightsaber =0.2.0, =0.1.0, =2.0.0, =0.1.2, =0.1.0, =0.0.3, =0.0.970 Source cves: CVE-2022-0845 Source...

Code injection

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

anomalib (>=0.2.2, <=0.2.4), argos-trains (0.1.0) +146 more potentially affected by CVE-2022-0845 via pytorch-lightning (>=1.0.5, <=1.5.10.post0)

pytorch-lightning PYPI version =1.0.5, =0.2.2, =0.5.0rc0, =0.3.2b20220222, =0.3.2b20220222, =0.0.1, =0.0.7, =3.0.0, =0.5.9, =0.0.1, =0.1.1 - bytesep-fancybit 0.0.8 and more Source cves: CVE-2022-0845 Source advisory: OSV:PYSEC-2022-181...

formerbox (>=0.1.8, <=0.1.10), npvcc2016 (>=1.0.3, <=1.2.1) +2 more potentially affected by CVE-2022-0845 via pytorch-lightning (0.10.0)

pytorch-lightning PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - formerbox =0.1.8, =1.0.3, =1.2.1 - pytorch-forecasting 0.5.0 - pytorch-pqrnn 0.1.0 Source cves: CVE-2022-0845 Source advisory...

databalancer (>=0.0.7, <=0.0.8), torchline (>=0.3.0.0a0, <=0.3.0.1) potentially affected by CVE-2022-0845 via pytorch-lightning (0.7.5)

pytorch-lightning PYPI version 0.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - databalancer =0.0.7, =0.3.0.0a0, =0.3.0.1 Source cves: CVE-2022-0845 Source advisory: OSV:PYSEC-2022-181...

PYSEC-2022-181

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

CVE-2022-0845 Code Injection in pytorchlightning/pytorch-lightning

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

CVE-2022-0845

CVE-2022-0845 affects PyTorch Lightning (repository pytorchlightning/pytorch-lightning) and is a Code Injection vulnerability present in releases prior to 1.6.0. Public descriptions indicate an injection path enabling code execution and, in some sources, exploitation of trainer configuration (e.g...

anomalib (>=0.2.2, <=0.2.4), argos-trains (0.1.0) +170 more potentially affected by CVE-2022-0845 via pytorch-lightning (>=0.5.3.2, <=1.5.10.post0)

pytorch-lightning PYPI version =0.5.3.2, =0.2.2, =0.1.1, =0.3.2b20220222, =0.3.2b20220222, =0.0.1, =0.0.7, =3.0.0, =3.3.0 and more Source cves: CVE-2022-0845 Source advisory: MEND:CVE-2022-0845...

CVE-2022-0845

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

CVE-2022-0845: Improper Control of Generation of Code

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

pytorch-lightning 代码注入漏洞

Pytorch-Lightning is an open source lightweight PyTorch wrapper for high-performance Ai research. Used for high-performance Ai research, Pytorch-Lightning is vulnerable to a code injection vulnerability that could be exploited to inject code into the GitHub repository...

Code Injection

Description The attacker can execute commands on the target OS running the operating system by setting the PLTRAINERGPUS when using the Trainer module. Proof of Concept bash $ pip3 install pytorch-lightning python import os from pytorchlightning import Trainer from...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2022-23579 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2022-23579 Source advisory: OSV:GHSA-5F2R-QP73-37MR...