Path Traversal in Pytorch Serve
CVE-2023-48299
TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.007 (50.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Pytorch Serve — versions >= 0.1.0, < 0.9.0
- Pytorch Torchserve
Weakness classification (CWE)
References
- github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp (Patch, Vendor Advisory)
- github.com/pytorch/serve/pull/2634 (Patch)
- github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb (Patch)
- github.com/pytorch/serve/releases/tag/v0.9.0 (Release Notes)
Frequently asked questions
- What is CVE-2023-48299?
- CVE-2023-48299 is a medium-severity vulnerability in Pytorch Serve, classified under Path Traversal. CVSS score: 5.3/10. Published 2023-11-21.
- How severe is CVE-2023-48299?
- Medium severity. CVSS v3 base score is 5.3 out of 10.