Pickle-Deserialization-Exploit-in-Transformers

Transformers의 pickle 역직렬화 취약점 악용 실험 소개 pickle 역직렬화 메커니즘과 reduce 공격 원리를 소개하고, Hugging Face Transformers 라이브러리의 역직렬화 취약점 CVE-2024-3568을 재현하며, Transformers 라이브러리의 보안 위험을 분석하고 보안 강화를 위한 효과적인 방안을 제시합니다. 자세한 내용은 실험 PDF 문서를 참조하세요. poc 작성자 코드는 CVE-2024-3568 또는 authorinf 폴더를 참조하세요. 주요 정보 1. 취약점 위치...

Security Bulletin: Multiple Vulnerabilities affect IBM Watson Studio in Cloud Pak for Data.

Summary Multiple vulnerabilities have been addressed in IBM Watson Studio in Cloud Pak for Data version 5.2.2 Vulnerability Details CVEID:CVE-2024-3568 DESCRIPTION: The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the...

Exploit for CVE-2024-3568

Exploitation of pickle deserialization vulnerabilities in Tran...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in transformers 4.36.2

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of transformers 4.36.2 Vulnerability Details CVEID:CVE-2024-3568 DESCRIPTION: The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the...

CVE-2024-3568

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadrepocheckpoint function of the TFPreTrainedModel class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting...