GitHub Advisoryadvisory · PyPI

GHSA-47wv-vhj2-g66m Use of insecure temporary file in Horovod

HIGH Published 2022-03-29 Modified 2024-09-20 Official page ↗
Aliases
CVE-2022-0315
Ecosystem
PyPI
Packages
horovod
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-377, CWE-668
Reviewed
2022-03-29

Affected packages

• PyPI horovod: < 0.24.0 → fixed in 0.24.0

Description

Impact The insecure `tempfile.mktemp()` is used when Horovod is run in an LSF job with `jsrun`. In that situation, a jsrun rank file is created with `mktemp`, which could be hijacked by another process to read or manipulate the content. This issue does not impact the use of MPI, Gloo, Spark or Ray. Patches The problem has been fixed in b96ecae4. Workarounds The rank file is not created when `binding_args` are provided in the `Settings` instance. References Please see https://github.com/horovod/horovod/pull/3358 for details. For more information If you have any questions or comments about this advisory: • Open an issue in https://github.com/horovod/horovod

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2022-0315 Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0. vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References