Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The two gRPC ports 7070 and 7071, are not bound to localhost by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. Patches This issue in TorchServe has been fixed in #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. References #3083 TorchServe release v0.11.0 Thank Kroll Cyber Risk for for responsibly disclosing this issue. If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Recommended action: Upgrade to 0.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact TorchServe's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowedurls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. Patches This issue in TorchServe has been fixed by validating the URL without characters such as ".." before downloading: #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. References #3082 TorchServe release v0.11.0 Thank Kroll Cyber Risk for for responsibly disclosing this issue. If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Recommended action: Upgrade to 0.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. Patches The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them: https://github.com/pytorch/serve/pull/2634 TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability: https://github.com/pytorch/serve/releases/tag/v0.9.0 References https://github.com/pytorch/serve/pull/2634 https://github.com/pytorch/serve/releases/tag/v0.9.0 Credit We would like to thank Oligo Security for responsibly disclosing this issue. If you have any questions or comments about this advisory, we ask that…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Remote Server-Side Request Forgery (SSRF) Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. Mitigation: The user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowedurls and specifying the model URL to be used. A pull request to warn the user when the default value for allowedurls is used has been merged - https://github.com/pytorch/serve/pull/2534. TorchServe release 0.8.2 includes this change. Patches TorchServe release 0.8.2 includes fixes to address the previously listed issue: https://github.com/pytorch/serve/releases/tag/v0.8.2 Tags for upgraded DLC release User can use the following new image tags to pull DLCs…
Recommended action: Upgrade to 0.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target system. This issue is present in versions 0.3.0 to 0.8.1. Mitigation: A pull request to address this issue has been merged - https://github.com/pytorch/serve/pull/2523. TorchServe release 0.8.2 includes this fix. Patches TorchServe release 0.8.2 includes fixes to address the previously listed issue: https://github.com/pytorch/serve/releases/tag/v0.8.2 Tags for upgraded DLC release User can use the following new image tags to pull DLCs that ship with patched TorchServe version 0.8.2: x86 GPU v1.9-pt-ec2-2.0.1-inf-gpu-py310 v1.8-pt-sagemaker-2.0.1-inf-gpu-py310 x86 CPU v1.8-pt-ec2-2.0.1-inf-cpu-py310 v1.7-pt-sagemaker-2.0.1-inf-cpu-py310 Graviton v1.7-pt-graviton-ec2-2.0.1-inf-cpu-py310…
Recommended action: Upgrade to 0.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.