CVE-2020-28477

Advisory

Opacus 0.12.0 updates its dependency 'immer' to v8.0.1 to include a security fix.
https://github.com/pytorch/opacus/commit/4e8c77f1fd909fcc97b752ac955f450a1e6d2f71

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This version introduces a **mildly-breaking change**: the privacy engine will now support sampling with variable batch size, just like in the Abadi et al. paper. To accommodate this feature, we have made `batch_size` a kwarg (no longer positional). We are also enforcing that all kwargs must not be specified positionally. If you had code that passed kwargs positionally, you will find an error (which will be very simple to fix).
New features
* Enforce kwargs to Privacy Engine (136).
* Fix batch construction and privacy engine (128). (thanks ConstanceBeguier!)
* Compute required sigma to reach (epsilon, delta) budget (126)
* Friendly user message for unused parameters (118).
* Print helpful message when models are not in train mode (113)
Bug fixes
* Now the Opacus package has a `__version__` attribute.
* Fix immer security issue, fix website errors
* Updated setup.py version requirements to support 3.6.8 for Windows (108) (thanks madhavajay!)
Miscellaneous
* Rewrote the grad_sample tests to use Hypothesis (125). (thanks touqir14!)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28477