CVE-2022-45907: PyTorch vulnerable to arbitrary code execution
(updated )
In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely. The fix for this issue is available in version 1.13.1. There is a release checker in issue #89855.
References
- github.com/advisories/GHSA-47fc-vmwq-366v
- github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2022-43015.yaml
- github.com/pytorch/pytorch
- github.com/pytorch/pytorch/commit/767f6aa49fe20a2766b9843d01e3b7f7793df6a3
- github.com/pytorch/pytorch/issues/88868
- github.com/pytorch/pytorch/issues/89855
- github.com/pytorch/pytorch/pull/89189
- github.com/pytorch/pytorch/releases/tag/v1.13.1
- nvd.nist.gov/vuln/detail/CVE-2022-45907
Code Behaviors & Features
Detect and mitigate CVE-2022-45907 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →