AZL-41431
Dashboard / Vulnerabilities / AZL-41431
Summary: CVE-2021-22569 affecting package pytorch for versions less than 2.2.2-5
Details: An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
References: https://nvd.nist.gov/vuln/detail/CVE-2021-22569
Affected packages
Package
Name: pytorch
Purl: pkg:rpm/azure-linux/pytorch
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -2.2.2-5
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
