Rasa-cve-exp

Rasa-cve-exp CVE-2021-42556 server-1.py Just run it directly python server-1.py Arbitrary File Upload PUT /model "modelserver":"url":"http://192.168.244.128:5000/stage1","waittimebetweenpulls":0 Effect as follows: CVE-2021-41127 server-1.py Default model name: evilimportmodel.tar.gz Malicious mod...

CVE-2021-41127

Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model tar.gz file which allows a malicious actor to craft a model.tar.gz file which can overwrite or replace bot...

rukip (>=0.0.2, <=0.0.4) potentially affected by CVE-2021-41127 via rasa (1.4.6)

rasa PYPI version 1.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on rasa and may be impacted: - rukip =0.0.2, =0.0.4 Source cves: CVE-2021-41127 Source advisory: OSV:GHSA-4365-FHM5-QCRX...

rasa-nlu-gao (>=0.3.0, <=0.3.4), rasa-print (0.3.1) potentially affected by CVE-2021-41127 via rasa (1.1.8)

rasa PYPI version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on rasa and may be impacted: - rasa-nlu-gao =0.3.0, =0.3.4 - rasa-print 0.3.1 Source cves: CVE-2021-41127 Source advisory: OSV:GHSA-4365-FHM5-QCRX...

rasa-cli-completion (>=0.1.0, <=0.1.1), rasa-denerator (1.0.4) +1 more potentially affected by CVE-2021-41127 via rasa (1.10.26)

rasa PYPI version 1.10.26 is affected by a known vulnerability. The following packages have a transitive dependency on rasa and may be impacted: - rasa-cli-completion =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2021-41127 Source advisory: OSV:GHSA-4365-FHM5-QCRX...

rukip (>=0.0.2, <=0.0.4) potentially affected by CVE-2021-41127 via rasa (1.4.6)

rasa PYPI version 1.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on rasa and may be impacted: - rukip =0.0.2, =0.0.4 Source cves: CVE-2021-41127 Source advisory: OSV:PYSEC-2021-381...

rasa-cli-completion (>=0.1.0, <=0.1.1), rasa-denerator (1.0.4) +1 more potentially affected by CVE-2021-41127 via rasa (1.10.26)

rasa PYPI version 1.10.26 is affected by a known vulnerability. The following packages have a transitive dependency on rasa and may be impacted: - rasa-cli-completion =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2021-41127 Source advisory: OSV:PYSEC-2021-381...

askbob (>=0.0.3, <=0.0.4), rasa-extractors (>=0.1.0, <=0.1.2) +2 more potentially affected by CVE-2021-41127 via rasa (>=2.2.9, <=2.8.8)

rasa PYPI version =2.2.9, =0.0.3, =0.1.0, =0.0.1, =0.0.2, =1.1.6 Source cves: CVE-2021-41127 Source advisory: OSV:PYSEC-2021-381...

CVE-2021-41127

CVE-2021-41127 affects Rasa open source framework. A vulnerability exists in the model-loading path for trained archives (model.tar.gz) that can be crafted to overwrite or replace bot files in the bot directory. Root cause: arbitrary file write via crafted model archives during load. Impact per s...