torchserve@0.4.0 vulnerabilities

torchserve is a TorchServe is a tool for serving neural net models for inference

Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference. This is because the check on allowed_urls configuration can be bypassed if the URL contains characters such as .., which allows the targeted MAR file to be copied from the source to the model-store folder.

Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are unaffected.

Upgrade torchserve to version 0.11.0 or higher.

torchserve is a TorchServe is a tool for serving neural net models for inference

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to two gRPC ports 7070 and 7071 that are not bound to localhost by default.

Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected.

Upgrade torchserve to version 0.11.0 or higher.

torchserve is a TorchServe is a tool for serving neural net models for inference

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). An attacker can upload potentially harmful archives that contain files, which can be extracted to any location on the filesystem within the process permissions. This issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running the affected software.

Mitigation: This vulnerability can be mitigated by validating the paths of files contained within a zip archive before extracting them.

Upgrade torchserve to version 0.9.0 or higher.

torchserve is a TorchServe is a tool for serving neural net models for inference

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to the lack of proper input validation in the default configuration. An attacker can invoke remote HTTP download requests and write files to the disk, potentially compromising the integrity of the system and sensitive data.

Note

This is only exploitable if the default value for allowed_urls is used and the user specifies the model URL to be used. An attacker can load the model of their choice from any URL they wish to use. The impact of this vulnerability may vary based on specific configuration.

Upgrade torchserve to version 0.8.2 or higher.