Security Bulletin: Netty Vulnerability Affects IBM Watson Machine Learning on CP4D (CVE-2021-21295)

Summary Netty is vulnerable to HTTP request smuggling, caused by improper validation of Content-Length header by the Http2MultiplexHandler on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2021-21295 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by...

Machine Learning Testing for Data Scientists

In one software development project after another, it has been proven that testing saves time. Does this hold true for machine learning projects? Should data scientists write tests? Will it make their work better and/or faster? We believe the answer is YES! In this post we describe a full...

GHSA-V9J2-Q4Q5-CXH4 No CSRF protection on the password change form

Impact It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. Patches The problem has been patched in XWiki 12.10.5, 13.2RC1. Workarounds It's possible to apply the patch manually by modifying the registermacros.vm template like in...

GHSA-H4M4-PGP4-WHGM The reset password form reveal users email address

Impact The reset password form reveals the email address of users just by giving their username. Patches The problem has been patched on XWiki 13.2RC1. Workarounds It's possible to manually modify the resetpasswordinline.vm to perform the changes made in...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2021-28677 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2021-28675 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29619 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29619 Source advisory: OSV:GHSA-WVJW-P9F5-VQ28...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29618 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29618 Source advisory: OSV:GHSA-XQFJ-CR6Q-PC8W...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29617 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29617 Source advisory: OSV:GHSA-MMQ6-Q8R3-48FM...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29616 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29616 Source advisory: OSV:GHSA-4HVV-7X94-7VQ8...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29615 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29615 Source advisory: OSV:GHSA-QW5H-7F53-XRP6...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29614 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29614 Source advisory: OSV:GHSA-8PMX-P244-G88H...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29613 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29613 Source advisory: OSV:GHSA-VVG4-VGRV-XFR7...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29612 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29612 Source advisory: OSV:GHSA-2XGJ-XHGF-GGJV...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29610 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29610 Source advisory: OSV:GHSA-MQ5C-PRH3-3F3H...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29609 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29609 Source advisory: OSV:GHSA-CJC7-49V2-JP64...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29608 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29608 Source advisory: OSV:GHSA-RGVQ-PCVF-HX75...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29606 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29606 Source advisory: OSV:GHSA-H4PC-GX2W-F2XV...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29605 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29605 Source advisory: OSV:GHSA-JF7H-7M85-W2V2...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2021-29604 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2021-29604 Source advisory: OSV:GHSA-8RM6-75MF-7R7R...