GitHub Advisoryadvisory · Maven

GHSA-rc39-g977-687w Use of unclaimed s3 bucket in tests and examples

MEDIUM Published 2022-11-10 Modified 2022-11-10 Official page ↗
Aliases
CVE-2022-36022
Ecosystem
Maven
Packages
org.deeplearning4j:platform-tests, org.deeplearning4j:dl4j-examples
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-330, CWE-344
Reviewed
2022-11-10

Affected packages

• Maven org.deeplearning4j:platform-tests: <= 1.0.0-M2.1 (no fix yet) • Maven org.deeplearning4j:dl4j-examples: <= 1.0.0-M2.1 (no fix yet)

Description

Impact People who use some older NLP examples that reference the old S3 bucket. Patches The problem has been patched. Upgrade to snapshots for now. A release will be published later to address this due to the vulnerability mostly being examples and 1 class in the actual code base. Workarounds Download a word2vec google news vector from a new source using git lfs

Related

Alias · CVE (1)

  • CVE-2022-36022 Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. vulnerability

Weakness · CWE (2)

  • CWE-330 Use of Insufficiently Random Values weakness
  • CWE-344 Use of Invariant Value in Dynamically Changing Context weakness

References