Search
Find a vulnerability
Search criteria
2 vulnerabilities found for djl by deepjavalibrary
CVE-2024-37902 (GCVE-0-2024-37902)
Vulnerability from nvd – Published: 2024-06-17 19:25 – Updated: 2024-08-02 04:04
VLAI
EPSS
VEX
Title
Path thraversal in DeepJavaLibrary
Summary
DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/deepjavalibrary/djl/security/a… | x_refsource_CONFIRM |
| https://github.com/deepjavalibrary/djl/releases/t… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| deepjavalibrary | djl |
Affected:
>= 0.1.0, < 0.28.0
|
|
| deepjavalibrary | djl |
Affected:
0.1.0 , < 0.28
(custom)
cpe:2.3:a:deepjavalibrary:djl:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:deepjavalibrary:djl:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "djl",
"vendor": "deepjavalibrary",
"versions": [
{
"lessThan": "0.28",
"status": "affected",
"version": "0.1.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37902",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-18T14:02:14.127320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-18T14:05:47.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:04:23.429Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj"
},
{
"name": "https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "djl",
"vendor": "deepjavalibrary",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.28.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T19:25:21.831Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj"
},
{
"name": "https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0"
}
],
"source": {
"advisory": "GHSA-w877-jfw7-46rj",
"discovery": "UNKNOWN"
},
"title": "Path thraversal in DeepJavaLibrary"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-37902",
"datePublished": "2024-06-17T19:25:21.831Z",
"dateReserved": "2024-06-10T19:54:41.362Z",
"dateUpdated": "2024-08-02T04:04:23.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37902 (GCVE-0-2024-37902)
Vulnerability from cvelistv5 – Published: 2024-06-17 19:25 – Updated: 2024-08-02 04:04
VLAI
EPSS
VEX
Title
Path thraversal in DeepJavaLibrary
Summary
DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/deepjavalibrary/djl/security/a… | x_refsource_CONFIRM |
| https://github.com/deepjavalibrary/djl/releases/t… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| deepjavalibrary | djl |
Affected:
>= 0.1.0, < 0.28.0
|
|
| deepjavalibrary | djl |
Affected:
0.1.0 , < 0.28
(custom)
cpe:2.3:a:deepjavalibrary:djl:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:deepjavalibrary:djl:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "djl",
"vendor": "deepjavalibrary",
"versions": [
{
"lessThan": "0.28",
"status": "affected",
"version": "0.1.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37902",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-18T14:02:14.127320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-18T14:05:47.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:04:23.429Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj"
},
{
"name": "https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "djl",
"vendor": "deepjavalibrary",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.28.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T19:25:21.831Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj"
},
{
"name": "https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0"
}
],
"source": {
"advisory": "GHSA-w877-jfw7-46rj",
"discovery": "UNKNOWN"
},
"title": "Path thraversal in DeepJavaLibrary"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-37902",
"datePublished": "2024-06-17T19:25:21.831Z",
"dateReserved": "2024-06-10T19:54:41.362Z",
"dateUpdated": "2024-08-02T04:04:23.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}