EUVD-2024-0034

Malicious code in bioql PyPI...

aistrainer (>=0.0.1 <=0.0.13), aivoifu (>=0.2.8 <=0.2.9) +21 more potentially affected by unknown CVE via deepspeed (>=0.10.2 <=0.15.1)

deepspeed PYPI version =0.10.2, =0.0.1, =0.2.8, =0.2.0, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =0.4.1 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-DEEPSPEED-8320951...

Command Injection

Overview deepspeed is a DeepSpeed library Affected versions of this package are vulnerable to Command Injection when multiple instances where subprocess.run and subprocess.checkoutput, are called with unsanitized input and shell=True. An attacker would need to supply specially crafted input to...

The vulnerability of Microsoft DeepSpeed’s optimization library, related to the failure to take measures to neutralize special elements used in the operating system’s command set, allows attackers to execute arbitrary code.

The vulnerability of Microsoft DeepSpeed’s optimization library relates to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability can allow attackers to execute arbitrary code...

Microsoft DeepSpeed Remote Code Execution Vulnerability

Microsoft DeepSpeed is an easy-to-use deep learning optimization software suite from Microsoft that delivers unprecedented scale and speed for DL training and inference. A remote code execution vulnerability exists in Microsoft DeepSpeed, which can be exploited by an attacker to execute arbitrary...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed vulnerabilities in several Developer Tools. A malicious person could exploit the vulnerabilities to cause a Denial-of-Service, grant themselves elevated privileges or execute arbitrary code with the victim's privileges. Successful exploitation requires the malicious party to...

DeepSpeed Remote Code Execution Vulnerability

DeepSpeed Remote Code Execution Vulnerability...

aistrainer (>=0.0.1 <=0.0.11), aivoifu (>=0.2.8 <=0.2.9) +20 more potentially affected by CVE-2024-43497 via deepspeed (>=0.10.2 <=0.15.0)

deepspeed PYPI version =0.10.2, =0.0.1, =0.2.8, =0.2.0, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =0.4.1 and more Source cves: CVE-2024-43497 Source advisory: SNYK:PYTHON-DEEPSPEED-8230423...

Arbitrary Command Injection

Overview deepspeed is a DeepSpeed library Affected versions of this package are vulnerable to Arbitrary Command Injection through the execution of unauthorized commands or code. An attacker can execute arbitrary code on the system by sending crafted inputs to the affected function. Remediation...

GHSA-8CP5-3RF8-8GFH DeepSpeed Remote Code Execution Vulnerability

DeepSpeed Remote Code Execution Vulnerability...

CVE-2024-43497

DeepSpeed Remote Code Execution Vulnerability...

CVE-2024-43497

DeepSpeed Remote Code Execution Vulnerability...

PYSEC-2024-109

DeepSpeed Remote Code Execution Vulnerability...

PYSEC-2024-109

DeepSpeed Remote Code Execution Vulnerability...

CVE-2024-43497 DeepSpeed Remote Code Execution Vulnerability

...

CVE-2024-43497 DeepSpeed Remote Code Execution Vulnerability

...

CVE-2024-43497

CVE-2024-43497 covers a DeepSpeed remote code execution vulnerability. Connected sources indicate Microsoft DeepSpeed is affected (including DeepSpeed versions before 0.15.1 per Nessus plugin), enabling arbitrary code execution under exploitable conditions. Public references describe the issue as...

DeepSpeed Remote Code Execution Vulnerability

...

DeepSpeed Detection

A DeepSpeed Python library is installed on the remote host. Note that Nessus has relied upon on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'xcompat.inc'; if description scriptid208299; scriptversion"1.4";...

DeepSpeed < 0.15.1 Command Injection

The remote host contains a DeepSpeedserve version that is prior to 0.15.1. It is, therefore, affected by an arbitrary code execution vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...