Use of Incorrectly-Resolved Name or Reference Affecting torchserve package, versions [,0.11.0)
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-TORCHSERVE-7577198
- published 1 Aug 2024
- disclosed 1 Aug 2024
- credit Kroll Cyber Risk
Introduced: 1 Aug 2024
CVE-2024-35198 Open this link in a new tabHow to fix?
Upgrade torchserve to version 0.11.0 or higher.
Overview
torchserve is a TorchServe is a tool for serving neural net models for inference
Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference. This is because the check on allowed_urls configuration can be bypassed if the URL contains characters such as .., which allows the targeted MAR file to be copied from the source to the model-store folder.
Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are unaffected.