Path Traversal in Deepjavalibrary Deepjavalibrary/djl
CVE-2024-2914
A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manipulate file paths within tar archives to overwrite arbitrary files on the target system. Exploitation of this vulnerability could lead to remote code execution, privilege escalation, data theft or manipulation, and denial of service. The vulnerability is due to improper validation of file paths during the extraction of tar files, as demonstrated in multiple occurrences within the library's codebase, including but not limited to the files_util.py and extract_imagenet.py scripts.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (58.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 58.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Deepjavalibrary Deepjavalibrary/djl — versions unspecified
- Djl Deep Java Library — versions 0.26.0
Weakness classification (CWE)
References
- huntr.com/bounties/b064bd2f-bf6e-4fc0-898e-7d02a9b97e24 (Exploit, Patch, Third Party Advisory, Issue Tracking)
- github.com/deepjavalibrary/djl/commit/5235be508cec9e8cb6f496a4ed2fa40e4f62c370 (Patch)
Frequently asked questions
- What is CVE-2024-2914?
- CVE-2024-2914 is a high-severity vulnerability in Deepjavalibrary Deepjavalibrary/djl, classified under CWE-29. CVSS score: 8.8/10. Published 2024-06-06.
- How severe is CVE-2024-2914?
- High severity. CVSS v3 base score is 8.8 out of 10.