Homepage
About Snyk

torchserve@0.10.0 vulnerabilities

TorchServe is a tool for serving neural net models for inference

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the torchserve package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Use of Incorrectly-Resolved Name or Reference

torchserve is a TorchServe is a tool for serving neural net models for inference

Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference. This is because the check on allowed_urls configuration can be bypassed if the URL contains characters such as .., which allows the targeted MAR file to be copied from the source to the model-store folder.

Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are unaffected.

How to fix Use of Incorrectly-Resolved Name or Reference?

Upgrade torchserve to version 0.11.0 or higher.

[,0.11.0)
  • M
Exposure of Resource to Wrong Sphere

torchserve is a TorchServe is a tool for serving neural net models for inference

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to two gRPC ports 7070 and 7071 that are not bound to localhost by default.

Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected.

How to fix Exposure of Resource to Wrong Sphere?

Upgrade torchserve to version 0.11.0 or higher.

[0.3.0,0.11.0)
Go back to all versions of this package