CVE-2021-43811
CVSS V2 Medium 6.8
CVSS V3 High 7.8
Description
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.
Overview
- CVE ID
- CVE-2021-43811
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-12-08T23:15:08
- Last Modified Date
- 2021-12-13T19:15:46
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:amazon:sockeye:*:*:*:*:*:python:*:* | 1 | OR | 2.3.24 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 6.8
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector
- LOCAL
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 7.8
- Base Severity
- HIGH
- Exploitability Score
- 1.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pm | Third Party Advisory |
| https://github.com/awslabs/sockeye/releases/tag/2.3.24 | Release Notes Third Party Advisory |
| https://github.com/awslabs/sockeye/pull/964 | Patch Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-43811 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43811 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 06:41:30 | Added to TrackCVE | |||
| 2022-12-06 03:26:55 | 2021-12-08T23:15Z | 2021-12-08T23:15:08 | CVE Published Date | updated |
| 2022-12-06 03:26:55 | 2021-12-13T19:15:46 | CVE Modified Date | updated | |
| 2022-12-06 03:26:55 | Analyzed | Vulnerability Status | updated |