transformers-4.9.2-py3-none-any.whl: 7 vulnerabilities (highest severity is: 8.8)
mend-bolt-for-github opened this issue · 0 comments
Vulnerable Library - transformers-4.9.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/f9/35/75ade98da1e5b36a7a055fa3257d9b61769914a416b8844d6e4b237219e4/transformers-4.9.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (transformers version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2024-11394 |  High |
8.8 | transformers-4.9.2-py3-none-any.whl | Direct | N/A | ❌ |
| CVE-2024-11393 | High |
8.8 | transformers-4.9.2-py3-none-any.whl | Direct | N/A | ❌ |
| CVE-2024-11392 | High |
8.8 | transformers-4.9.2-py3-none-any.whl | Direct | N/A | ❌ |
| CVE-2023-6730 | High |
8.8 | transformers-4.9.2-py3-none-any.whl | Direct | 4.36.0 | ❌ |
| CVE-2023-7018 | High |
7.8 | transformers-4.9.2-py3-none-any.whl | Direct | 4.36.0 | ❌ |
| CVE-2023-2800 |  Medium |
4.7 | transformers-4.9.2-py3-none-any.whl | Direct | 4.30.1 | ❌ |
| CVE-2024-3568 |  Low |
3.4 | transformers-4.9.2-py3-none-any.whl | Direct | 4.38.0 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-11394
Vulnerable Library - transformers-4.9.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/f9/35/75ade98da1e5b36a7a055fa3257d9b61769914a416b8844d6e4b237219e4/transformers-4.9.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ transformers-4.9.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad
Found in base branch: main
Vulnerability Details
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25012.
Publish Date: 2024-11-22
URL: CVE-2024-11394
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2024-11393
Vulnerable Library - transformers-4.9.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/f9/35/75ade98da1e5b36a7a055fa3257d9b61769914a416b8844d6e4b237219e4/transformers-4.9.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ transformers-4.9.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad
Found in base branch: main
Vulnerability Details
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25191.
Publish Date: 2024-11-22
URL: CVE-2024-11393
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2024-11392
Vulnerable Library - transformers-4.9.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/f9/35/75ade98da1e5b36a7a055fa3257d9b61769914a416b8844d6e4b237219e4/transformers-4.9.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ transformers-4.9.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad
Found in base branch: main
Vulnerability Details
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-24322.
Publish Date: 2024-11-22
URL: CVE-2024-11392
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2023-6730
Vulnerable Library - transformers-4.9.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/f9/35/75ade98da1e5b36a7a055fa3257d9b61769914a416b8844d6e4b237219e4/transformers-4.9.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ transformers-4.9.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad
Found in base branch: main
Vulnerability Details
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Publish Date: 2023-12-19
URL: CVE-2023-6730
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16/
Release Date: 2023-12-19
Fix Resolution: 4.36.0
Step up your Open Source Security Game with Mend here
CVE-2023-7018
Vulnerable Library - transformers-4.9.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/f9/35/75ade98da1e5b36a7a055fa3257d9b61769914a416b8844d6e4b237219e4/transformers-4.9.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ transformers-4.9.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad
Found in base branch: main
Vulnerability Details
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Publish Date: 2023-12-20
URL: CVE-2023-7018
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-7018
Release Date: 2023-12-20
Fix Resolution: 4.36.0
Step up your Open Source Security Game with Mend here
CVE-2023-2800
Vulnerable Library - transformers-4.9.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/f9/35/75ade98da1e5b36a7a055fa3257d9b61769914a416b8844d6e4b237219e4/transformers-4.9.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ transformers-4.9.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad
Found in base branch: main
Vulnerability Details
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
Publish Date: 2023-05-18
URL: CVE-2023-2800
CVSS 3 Score Details (4.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a/
Release Date: 2023-05-18
Fix Resolution: 4.30.1
Step up your Open Source Security Game with Mend here
CVE-2024-3568
Vulnerable Library - transformers-4.9.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/f9/35/75ade98da1e5b36a7a055fa3257d9b61769914a416b8844d6e4b237219e4/transformers-4.9.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ transformers-4.9.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad
Found in base branch: main
Vulnerability Details
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the load_repo_checkpoint() function of the TFPreTrainedModel() class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of pickle.load() on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine.
Publish Date: 2024-04-10
URL: CVE-2024-3568
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-3568
Release Date: 2024-04-10
Fix Resolution: 4.38.0
Step up your Open Source Security Game with Mend here