CVE-2022-46742: PaddlePaddle vulnerable to Code Injection
(updated )
Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. A patch is available on the develop branch of the repository and anticipated to be part of a 2.4 release.
References
- github.com/PaddlePaddle/Paddle
- github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-002.md
- github.com/PaddlePaddle/Paddle/commit/26c419ca386aeae3c461faf2b828d00b48e908eb
- github.com/PaddlePaddle/Paddle/pull/47386
- github.com/advisories/GHSA-gcjf-29m9-888q
- github.com/pypa/advisory-database/tree/main/vulns/paddlepaddle/PYSEC-2022-43063.yaml
- nvd.nist.gov/vuln/detail/CVE-2022-46742
Code Behaviors & Features
Detect and mitigate CVE-2022-46742 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →