Ubuntu.comUB:CVE-2022-25882CVE-2022-25882
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
56.2%
Versions of the package onnx before 1.13.0 are vulnerable to Directory
Traversal as the external_data field of the tensor proto can have a path to
the file which is outside the model current directory or user-provided
directory, for example “…/…/…/etc/passwd”
Notes
| Author | Note |
|---|---|
| ccdm94 | it seems like the external_data field, which leads to the vulnerability, was only introduced in version 1.4.0 of onnx, as per information recovered from PR 678 and commit 51b6ecce (see https://github.com/onnx/onnx/releases/tag/v1.4.0 as well for more information). This means versions prior to version 1.4.0 are not vulnerable. |
References
gist.github.com/jnovikov/02a9aff9bf2188033e77bd91ff062856
github.com/onnx/onnx/blob/96516aecd4c110b0ac57eba08ac236ebf7205728/onnx/checker.cc%23L129
github.com/onnx/onnx/commit/f369b0e859024095d721f1d1612da5a8fa38988d
github.com/onnx/onnx/issues/3991
github.com/onnx/onnx/pull/4400
launchpad.net/bugs/cve/CVE-2022-25882
nvd.nist.gov/vuln/detail/CVE-2022-25882
security-tracker.debian.org/tracker/CVE-2022-25882
security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479
www.cve.org/CVERecord?id=CVE-2022-25882
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
56.2%