RCE in Amazon Sockeye
CVE-2021-43811
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.024 (82.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Amazon Sockeye
- Awslabs Sockeye — versions < 2.3.24
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2021-43811?
- CVE-2021-43811 is a high-severity vulnerability in Amazon Sockeye, classified under Code Injection. CVSS score: 7.8/10. Published 2021-12-08.
- How severe is CVE-2021-43811?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2021-43811 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.