TensorFlow vulnerable to integer overflow in math ops

ImpactWhen RangeSize receives values that do not fit into an int64t, it crashes.cpp auto size = std::isintegral::value ? Eigen::numext::abslimit - start + Eigen::numext::absdelta - T1 / Eigen::numext::absdelta : Eigen::numext::ceil Eigen::numext::abslimit - start / delta; // This check does not...

TensorFlow vulnerable to assertion fail on MLIR empty edge names

ImpactWhen mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it crashes.cpp// We pre-allocate the array of operands and populate it using the// outputnametoposition and controloutputtoposition populated// previously.SmallVector retvalsfunc.retsize +...

Missing validation crashes `QuantizeAndDequantizeV4Grad`

ImpactThe implementation of tf.rawops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.rawops.QuantizeAndDequantizeV4Grad gradients=tf.constant1,...

Out-of-bounds Write in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9 has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread...

Open redirect in gradio

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

ImpactJupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. The configuration for this would look like:python Require users to be using the "foo.horse" identity provider, often an institution or...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

Ryu Infinite Loop vulnerability

OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service infinite loop via length=0...

Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing

ImpactAffected configurations:- Single-origin JupyterHub deployments- JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server.By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS...

Potential log injection in reset user endpoint in CKAN

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. PatchesThis has been fixed in the CKAN 2.9.11 and 2.10.4 versions WorkaroundsOverride the...

JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

Affected versionVendor: https://github.com/latchset/jwcryptoVersion: 1.5.5 DescriptionAn attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio.When the server processes this Token, it will consume a lot of memory and processing time. Pocpythonfrom...

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

ImpactSince version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if urlfetcher is configured to prevent access to files and URLs. PatchesFixed by 734ee8e that’s included in 61.2 Workarounds- Check that no PDF attachment...

Allegro AI ClearML path traversal vulnerability

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...

vantage6 has insecure SSH configuration for node and server containers

ImpactNodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive.We will probably opt to complete...

MLflow Local File Disclosure Vulnerability

This vulnerability enables malicious users to read sensitive files on the server...

DockerSpawner allows any image by default

ImpactUsers of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowedimages configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended. PatchesUpgrade to DockerSpawner 13...

Information exposure in MLflow

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

Apache Superset Open Redirect vulnerability

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0...

Download to arbitrary folder can lead to RCE

SummaryA web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts. DetailsWhen a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a...

Ansible galaxy-importer Path Traversal vulnerability

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten...

Denial of service in neutron

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...

Keylime's registrar vulnerable to Denial-of-service attack via a single open connection

ImpactKeylime registrar is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port by default, port 8891 blocking further, legitimate connections. As long as the connection is open, the registrar is blocked and cannot serve any further clients agents an...

kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload

ImpactKiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The...

Connection confusion in gRPC

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this...

Improper Restriction of Excessive Authentication Attempts in calibreweb

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20...

TensorFlow has Null Pointer Error in SparseSparseMaximum

ImpactWhen SparseSparseMaximum is given invalid sparse tensors as inputs, it can give an NPE. pythonimport tensorflow as tftf.rawops.SparseSparseMaximum aindices=1, avalues = 0.1 , ashape = 2, bindices=, bvalues =2 , bshape = 2, PatchesWe have patched the issue in GitHub commit...

TensorFlow has Floating Point Exception in AudioSpectrogram

Impactversion:2.11.0 //core/ops/audioops.cc:70Status SpectrogramShapeFnInferenceContext c ShapeHandle input; TFRETURNIFERRORc-WithRankc-input0, 2, ; int32t windowsize; TFRETURNIFERRORc-GetAttr"windowsize", size; int32t stride; TFRETURNIFERRORc-GetAttr"stride", ; .....1DimensionHandle inputlength ...

TensorFlow has Null Pointer Error in LookupTableImportV2

ImpactThe function tf.rawops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE.pythonimport tensorflow as tfv = [email protected]=Truedef test: func = tf.rawops.LookupTableImportV2 para='tablehandle': v.handle,'keys': 62.98910140991211,...

tripleo-ansible may disclose important configuration details from an OpenStack deployment

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information...

TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad

ImpactOut of bounds read in GRUBlockCellGradpythonfunc = tf.rawops.GRUBlockCellGradpara = 'x': 21.1, 156.2, 83.3, 115.4, 'hprev': array136.5, 136.6, 'wru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'wc': array 0.4, 31.5, 0.6, 'bru': array0.1, 0.2 , dtype=float32, 'bc': 0x41414141, 'r': array0.3, 0....

TensorFlow has Segfault in Bincount with XLA

ImpactWhen running with XLA, tf.rawops.Bincount segfaults when given a parameter weights that is neither the same shape as parameter arr nor a length-0 tensor.pythonimport tensorflow as tffunc = tf.rawops.Bincountpara='arr': 6, 'size': 804, 'weights': 52, [email protected]=Truedef fuzzjit...

Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling

HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi. This issue affects Apache HTTP Server from 2.4.30 through 2.4.55 and the uWSGI PyPI package prior to version 2.0.22. Special characters in the origin response header can truncate/split the response forwarded to the...

Path traversal in binwalk

A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 inclusive. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode -e option. Remo...

Apache Superset has Improper Access Control

When explicitly enabling the feature flag DASHBOARDCACHE disabled by default, the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...

Apache Superset is vulnerable to Cross-Site Scripting (XSS)

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...

Tensorflow vulnerable to Out-of-Bounds Read

ImpactWhen the BaseCandidateSamplerOp function receives a value in trueclasses larger than rangemax, a heap oob vuln occurs.pythontf.rawops.ThreadUnsafeUnigramCandidateSampler trueclasses=0x100000,1, numtrue = 2, numsampled = 2, unique = False, rangemax = 2, seed = 2, seed2 = 2 PatchesWe have...

`CHECK` fail via inputs in `PyFunc`

ImpactAn input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc.pythonimport tensorflow as tfvalue = tf.constantvalue=1,2token = b'\xb0'dataType = tf.int32tf.rawops.PyFuncinput=value,token=token,Tout=dataType PatchesWe have patched the issue in GitHub commit...

FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess

ImpactAn input poolingratio that is smaller than 1 will trigger a heap OOB in tf.rawops.FractionalMaxPool and tf.rawops.FractionalAvgPool. PatchesWe have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48.The fix will be included in TensorFlow 2.11.0. We will also cherry...

Out of bounds write in grappler in Tensorflow

ImpactThe function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. PatchesWe have patched the issue in GitHub commit...

`CHECK_EQ` fail via input in `SparseMatrixNNZ`

ImpactAn input sparsematrix that is not a matrix with a shape with rank 0 will trigger a CHECK fail in tf.rawops.SparseMatrixNNZ.pythonimport tensorflow as tftf.rawops.SparseMatrixNNZsparsematrix= PatchesWe have patched the issue in GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693.The fix...

Cross-site Scripting in kiwitcms

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack clickjacking and an HTML injection which disables the use of the history page...

`MirrorPadGrad` heap out of bounds read

ImpactIf MirrorPadGrad is given outsize input paddings, TensorFlow will give a heap OOB error.pythonimport tensorflow as tftf.rawops.MirrorPadGradinput=1, paddings=0x77f00000,0xa000000, mode = 'REFLECT' PatchesWe have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92.The...

Powerline Gitstatus vulnerable to arbitrary code execution

powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...

Inventree vulnerable to Stored Cross-site Scripting

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue...

TensorFlow vulnerable to segfault in `QuantizedRelu` and `QuantizedRelu6`

ImpactIf QuantizedRelu or QuantizedRelu6 are given nonscalar inputs for minfeatures or maxfeatures, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfouttype = tf.quint8features = tf.constant28, shape=4,2, dtype=tf.quint8minfeatures =...

TensorFlow vulnerable to segfault in `QuantizedMatMul`

ImpactIf QuantizedMatMul is given nonscalar input for: - mina - maxa - minb - maxbIt gives a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfToutput = tf.qint32transposea = Falsetransposeb = FalseTactivation = tf.quint8a = tf.constant7, shape=3,4,...

TensorFlow vulnerable to `CHECK` fail in `LRNGrad`

ImpactIf LRNGrad is given an outputimage input tensor that is not 4-D, it results in a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfdepthradius = 1bias = 1.59018219alpha = 0.117728651beta = 0.404427052inputgrads = tf.random.uniformshape=4, 4, 4, 4...

TensorFlow vulnerable to segfault in `QuantizedBiasAdd`

ImpactIf QuantizedBiasAdd is given mininput, maxinput, minbias, maxbias tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfouttype = tf.qint32input = tf.constant85,170,255, shape=3, dtype=tf.quint8bias =...

TensorFlow vulnerable to segfault in `RaggedBincount`

ImpactIf RaggedBincount is given an empty input tensor splits, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfbinaryoutput = Truesplits = tf.random.uniformshape=0, minval=-10000, maxval=10000, dtype=tf.int64, seed=-7430values =...

TensorFlow vulnerable to `CHECK` fail in `Conv2DBackpropInput`

ImpactThe implementation of Conv2DBackpropInput requires inputsizes to be 4-dimensional. Otherwise, it gives a CHECK failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfstrides = 1, 1, 1, 1padding = "SAME"usecudnnongpu = Trueexplicitpaddings = dataformat =...