by Kastro
Paper/Archive/CVE-2024-37902

CVE-2024-37902

deepjavalibrary djl — Path thraversal in DeepJavaLibrary

EPSS 0.8%CVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 56.1.561 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.

Affected

ProductAffectedFixed inSource
djl>= 0.1.0, < 0.28.0–CNA
djl0.1.0 – < 0.280.28CISA-ADP

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rjrefgithub.com/deepjavalibrary/djl/releases/tag/v0.28.0