paddlepaddle@2.5.0 vulnerabilities

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to External Control of File Name or Path due to improper handling of external input through paddle.vision.ops.read_file. An attacker can achieve data exfiltration or cause a partial impact on data integrity by injecting malicious input.

There is no fixed version for paddlepaddle.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to Path Traversal due to improper limitation of a pathname to a restricted directory. An attacker can overwrite arbitrary files by submitting a crafted input containing "../" sequences to traverse directories.

Notes:

1. On servers that have SSH enabled, an attacker may be able to inject their own public RSA key into the authorized_keys file, leading to remote code execution.

2. On servers hosting web servers, various vulnerabilities can be exploited. On PHP or JSP server, remote code execution may be possible via uploading a webshell. On other servers an HTML file can be uploaded to achieve Cross-site Scripting (XSS)

3. Being able to overwrite files can also lead to impact in terms of availability. Overwriting configuration files, source code, and such may cause the server to not function properly anymore.

Upgrade paddlepaddle to version 2.6.1 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to Command Injection due to improper validation of user-supplied input in the IrGraph.draw method. An attacker can execute arbitrary commands on the system by injecting malicious commands into the method's input parameters.

Upgrade paddlepaddle to version 2.6.1 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to OS Command Injection due to improper input validation in the paddle.utils.download._wget_download function. An attacker can execute arbitrary commands by crafting malicious input that bypasses the filter.

Note: Depending on the context in which this code is used, this could lead to unauthorized access, data loss, or other potentially harmful consequences.

Upgrade paddlepaddle to version 2.6.1 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to Code Injection due to improper validation of user-supplied input. An attacker can execute arbitrary code on the system by sending a crafted request.

Upgrade paddlepaddle to version 2.6.1 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the _wget_download function, due to the url parameter being incorporated into the command string without proper validation or sanitization. An attacker can execute arbitrary code by injecting malicious input into the code generation routine.

Upgrade paddlepaddle to version 2.6.0 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to Divide By Zero via thepaddle.linalg.matrix_rank function, when x dim calculates rows or cols to 0. An attacker can cause a runtime crash.

Upgrade paddlepaddle to version 2.6.0 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to OS Command Injection via the convert_shape_compare function. An attacker can execute arbitrary commands on the operating system by supplying malicious input.

Upgrade paddlepaddle to version 2.6.0 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to OS Command Injection via the _wget_download function. An attacker can execute arbitrary commands on the operating system by injecting malicious input into the function.

Upgrade paddlepaddle to version 2.6.0 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') via the paddle.linalg.lu_unpack function. An attacker can cause a denial of service or potentially execute arbitrary code by providing specially crafted input to trigger this vulnerability.

Upgrade paddlepaddle to version 2.6.0 or higher.

paddlepaddle is a Parallel Distributed Deep Learning

Affected versions of this package are vulnerable to OS Command Injection via the get_online_pass_interval function. An attacker can execute arbitrary commands on the operating system by supplying malicious input.

Upgrade paddlepaddle to version 2.6.0 or higher.