GitHub Advisoryadvisory · PyPI

GHSA-hhpg-v63p-wp7w TorchServe gRPC Port Exposure

HIGH Published 2024-07-18 Modified 2024-08-07 Official page ↗
Aliases
CVE-2024-35199
Ecosystem
PyPI
Packages
torchserve
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weaknesses
CWE-1256, CWE-668
Reviewed
2024-07-18

Affected packages

• PyPI torchserve: >= 0.3.0, < 0.11.0 → fixed in 0.11.0

Description

Impact The two gRPC ports 7070 and 7071, are not bound to localhost by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. Patches This issue in TorchServe has been fixed in #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. References • #3083 • TorchServe release v0.11.0 Thank Kroll Cyber Risk for for responsibly disclosing this issue. If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Related

Alias · CVE (1)

  • CVE-2024-35199 TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. vulnerability

Weakness · CWE (2)

  • CWE-1256 Improper Restriction of Software Interfaces to Hardware Features weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References