Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/sockeye@1.18.67
Typepypi
Namespace
Namesockeye
Version1.18.67
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.3.24
Latest_non_vulnerable_version2.3.24
Affected_by_vulnerabilities
0
url VCID-3z5k-pnfu-pbha
vulnerability_id VCID-3z5k-pnfu-pbha
summary Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.
references
0
reference_url https://github.com/awslabs/sockeye
reference_id
reference_type
scores
url https://github.com/awslabs/sockeye
1
reference_url https://github.com/awslabs/sockeye/pull/964
reference_id
reference_type
scores
url https://github.com/awslabs/sockeye/pull/964
2
reference_url https://github.com/awslabs/sockeye/releases/tag/2.3.24
reference_id
reference_type
scores
url https://github.com/awslabs/sockeye/releases/tag/2.3.24
3
reference_url https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pm
reference_id
reference_type
scores
url https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pm
4
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/sockeye/PYSEC-2021-848.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/sockeye/PYSEC-2021-848.yaml
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-43811
reference_id CVE-2021-43811
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2021-43811
6
reference_url https://github.com/advisories/GHSA-ggmr-44cv-24pm
reference_id GHSA-ggmr-44cv-24pm
reference_type
scores
url https://github.com/advisories/GHSA-ggmr-44cv-24pm
fixed_packages
0
url pkg:pypi/sockeye@2.3.24
purl pkg:pypi/sockeye@2.3.24
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/sockeye@2.3.24
aliases CVE-2021-43811, GHSA-ggmr-44cv-24pm, PYSEC-2021-848
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3z5k-pnfu-pbha
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/sockeye@1.18.67