QID 995497

Date Published: 2023-10-03

QID 995497: Python (Pip) Security Update for torchserve (GHSA-8fxr-qfr9-p34w)

Remote Server-Side Request Forgery (SSRF) Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. Mitigation: The user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged - pytorch/serve#2534. TorchServe release 0.8.2 includes this change.

Successful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.

CVSS V3 rated as High - 6.5 severity.

CVSS V2 rated as Medium - 5.4 severity.

Solution

Refer to Github security advisory GHSA-8fxr-qfr9-p34w for updates and patch information.

Vendor References

GHSA-8fxr-qfr9-p34w - github.com/advisories/GHSA-8fxr-qfr9-p34w

CVEs related to QID 995497

CVE-2023-43654 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-8fxr-qfr9-p34w	torchserve		github.com/advisories/GHSA-8fxr-qfr9-p34w

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].