{"id":"GHSA-6h2x-4gjf-jc5w","summary":"autogluon.multimodal vulnerable to unsafe YAML deserialization","details":"### Impact\n\nA potential unsafe deserialization issue exists within the `autogluon.multimodal` module, where YAML files are loaded via `yaml.load()` instead of `yaml.safe_load()`. The deserialization of untrusted data may allow an unprivileged third party to cause remote code execution, denial of service, and impact to both confidentiality and integrity.\n\nImpacted versions: `\u003e=0.4.0;\u003c0.4.3`, `\u003e=0.5.0;\u003c0.5.2`.\n\n### Patches\nThe patches are included in `autogluon.multimodal==0.4.3`, `autogluon.multimodal==0.5.2` and Deep Learning Containers `0.4.3` and `0.5.2`.\n\n### Workarounds\nDo not load data which originated from an untrusted source, or that could have been tampered with. **Only load data you trust.**\n\n### References\n* https://cwe.mitre.org/data/definitions/502.html\n* https://www.cvedetails.com/cve/CVE-2017-18342/\n","modified":"2024-12-02T05:42:36.343453Z","published":"2022-09-21T21:42:05Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2022-09-21T21:42:05Z","nvd_published_at":null,"cwe_ids":["CWE-502"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/awslabs/autogluon/security/advisories/GHSA-6h2x-4gjf-jc5w"},{"type":"WEB","url":"https://github.com/awslabs/autogluon/pull/1987"},{"type":"WEB","url":"https://github.com/awslabs/autogluon/commit/23a37e74e58d03055c84a1b89c5af6c3db296b5e"},{"type":"PACKAGE","url":"https://github.com/awslabs/autogluon"}],"affected":[{"package":{"name":"autogluon-multimodal","ecosystem":"PyPI","purl":"pkg:pypi/autogluon-multimodal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.4.3"}]}],"versions":["0.4.3b20220616","0.4.3b20220617","0.4.3b20220618","0.4.3b20220619","0.4.3b20220620","0.4.3b20220621","0.4.3b20220622"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-6h2x-4gjf-jc5w/GHSA-6h2x-4gjf-jc5w.json"}},{"package":{"name":"autogluon-multimodal","ecosystem":"PyPI","purl":"pkg:pypi/autogluon-multimodal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.5.2"}]}],"versions":["0.5.0","0.5.1","0.5.1b20220624","0.5.1b20220625","0.5.1b20220626","0.5.1b20220627","0.5.1b20220628","0.5.1b20220629","0.5.1b20220630","0.5.1b20220701","0.5.1b20220702","0.5.1b20220703","0.5.1b20220704","0.5.1b20220705","0.5.1b20220706","0.5.1b20220707","0.5.1b20220708","0.5.1b20220709","0.5.1b20220710","0.5.1b20220711","0.5.1b20220712","0.5.1b20220713","0.5.1b20220714","0.5.1b20220715","0.5.1b20220716","0.5.1b20220717","0.5.1b20220718","0.5.2b20220719","0.5.2b20220720","0.5.2b20220721","0.5.2b20220722","0.5.2b20220723","0.5.2b20220724","0.5.2b20220725","0.5.2b20220726","0.5.2b20220727","0.5.2b20220728"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-6h2x-4gjf-jc5w/GHSA-6h2x-4gjf-jc5w.json"}}],"schema_version":"1.9.0"}