tlkh/paraphrase-metrics

spacy_transformers-1.1.5-py2.py3-none-any.whl: 9 vulnerabilities (highest severity is: 9.8)

mend-bolt-for-github opened this issue · 0 comments

mend-bolt-for-github commented
Vulnerable Library - spacy_transformers-1.1.5-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /textdiff_streamlit/requirements.txt,/paper/requirements.txt,/mrpc_streamlit/requirements.txt,/requirements.txt

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spacy_transformers version) Remediation Possible**
CVE-2022-21797 Critical 9.8 joblib-1.1.0-py2.py3-none-any.whl Transitive 1.1.6 ❌
CVE-2022-45907 Critical 9.8 torch-1.11.0-cp37-cp37m-manylinux1_x86_64.whl Transitive 1.1.6 ❌
CVE-2023-6730 Medium 5.5 transformers-4.17.0-py3-none-any.whl Transitive 1.1.8 ❌
CVE-2023-7018 Medium 5.5 transformers-4.17.0-py3-none-any.whl Transitive 1.1.8 ❌
CVE-2021-34141 Medium 5.3 numpy-1.21.6-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl Transitive 1.1.6 ❌
CVE-2023-2800 Medium 4.7 transformers-4.17.0-py3-none-any.whl Transitive 1.1.8 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-21797

Vulnerable Library - joblib-1.1.0-py2.py3-none-any.whl

Lightweight pipelining with Python functions

Library home page: https://files.pythonhosted.org/packages/3e/d5/0163eb0cfa0b673aa4fe1cd3ea9d8a81ea0f32e50807b0c295871e4aab2e/joblib-1.1.0-py2.py3-none-any.whl

Path to dependency file: /textdiff_streamlit/requirements.txt

Path to vulnerable library: /textdiff_streamlit/requirements.txt,/requirements.txt,/paper/requirements.txt

Dependency Hierarchy:

  • spacy_transformers-1.1.5-py2.py3-none-any.whl (Root Library)
    • transformers-4.17.0-py3-none-any.whl
      • sacremoses-0.0.53.tar.gz
        • ❌ joblib-1.1.0-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

Publish Date: 2022-09-26

URL: CVE-2022-21797

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-09-26

Fix Resolution (joblib): 1.2.0

Direct dependency fix Resolution (spacy-transformers): 1.1.6

Step up your Open Source Security Game with Mend here

CVE-2022-45907

Vulnerable Library - torch-1.11.0-cp37-cp37m-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/94/32/96a0955e5d6ed8a837eda5ca095dd2694c4617cfa70ca599660cd5ff7447/torch-1.11.0-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /textdiff_streamlit/requirements.txt

Path to vulnerable library: /textdiff_streamlit/requirements.txt,/paper/requirements.txt,/requirements.txt

Dependency Hierarchy:

  • spacy_transformers-1.1.5-py2.py3-none-any.whl (Root Library)
    • ❌ torch-1.11.0-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.

Publish Date: 2022-11-26

URL: CVE-2022-45907

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-45907

Release Date: 2022-11-26

Fix Resolution (torch): 1.13.1

Direct dependency fix Resolution (spacy-transformers): 1.1.6

Step up your Open Source Security Game with Mend here

CVE-2023-6730

Vulnerable Library - transformers-4.17.0-py3-none-any.whl

State-of-the-art Natural Language Processing for TensorFlow 2.0 and PyTorch

Library home page: https://files.pythonhosted.org/packages/a0/11/07cea2439c82726ee05575472e5b09c3b6eeac7e32eef1a736ad3646a8f0/transformers-4.17.0-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/paper/requirements.txt

Dependency Hierarchy:

  • spacy_transformers-1.1.5-py2.py3-none-any.whl (Root Library)
    • ❌ transformers-4.17.0-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Publish Date: 2023-12-19

URL: CVE-2023-6730

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16/

Release Date: 2023-12-12

Fix Resolution (transformers): 4.36.0

Direct dependency fix Resolution (spacy-transformers): 1.1.8

Step up your Open Source Security Game with Mend here

CVE-2023-7018

Vulnerable Library - transformers-4.17.0-py3-none-any.whl

State-of-the-art Natural Language Processing for TensorFlow 2.0 and PyTorch

Library home page: https://files.pythonhosted.org/packages/a0/11/07cea2439c82726ee05575472e5b09c3b6eeac7e32eef1a736ad3646a8f0/transformers-4.17.0-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/paper/requirements.txt

Dependency Hierarchy:

  • spacy_transformers-1.1.5-py2.py3-none-any.whl (Root Library)
    • ❌ transformers-4.17.0-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Publish Date: 2023-12-20

URL: CVE-2023-7018

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-7018

Release Date: 2023-12-20

Fix Resolution (transformers): 4.36.0

Direct dependency fix Resolution (spacy-transformers): 1.1.8

Step up your Open Source Security Game with Mend here

CVE-2021-34141

Vulnerable Library - numpy-1.21.6-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/6d/ad/ff3b21ebfe79a4d25b4a4f8e5cf9fd44a204adb6b33c09010f566f51027a/numpy-1.21.6-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

Path to dependency file: /textdiff_streamlit/requirements.txt

Path to vulnerable library: /textdiff_streamlit/requirements.txt,/paper/requirements.txt,/mrpc_streamlit/requirements.txt,/requirements.txt

Dependency Hierarchy:

  • spacy_transformers-1.1.5-py2.py3-none-any.whl (Root Library)
    • transformers-4.17.0-py3-none-any.whl
      • ❌ numpy-1.21.6-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Mend Note: After conducting further research, Mend has determined that versions 1.12.0 through 1.21.6 of numpy are vulnerable to CVE-2021-34141

Publish Date: 2021-12-17

URL: CVE-2021-34141

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34141

Release Date: 2021-12-17

Fix Resolution (numpy): 1.22.0

Direct dependency fix Resolution (spacy-transformers): 1.1.6

Step up your Open Source Security Game with Mend here

CVE-2023-2800

Vulnerable Library - transformers-4.17.0-py3-none-any.whl

State-of-the-art Natural Language Processing for TensorFlow 2.0 and PyTorch

Library home page: https://files.pythonhosted.org/packages/a0/11/07cea2439c82726ee05575472e5b09c3b6eeac7e32eef1a736ad3646a8f0/transformers-4.17.0-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/paper/requirements.txt

Dependency Hierarchy:

  • spacy_transformers-1.1.5-py2.py3-none-any.whl (Root Library)
    • ❌ transformers-4.17.0-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.

Publish Date: 2023-05-18

URL: CVE-2023-2800

CVSS 3 Score Details (4.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a/

Release Date: 2023-05-18

Fix Resolution (transformers): 4.30.1

Direct dependency fix Resolution (spacy-transformers): 1.1.8

Step up your Open Source Security Game with Mend here