CVE-2024-23334

Advisory

fmeval version 0.4.0 upgrades its aiohttp dependency to 3.9.3 from the earlier 3.9.1 in response to addressing the security vulnerability CVE-2024-23334.
https://github.com/aws/fmeval/pull/194/commits/b5a89e3912db8232670a44a908343038bb1fb5a4

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* feat: make sm/br runners easier to subclass by franluca in https://github.com/aws/fmeval/pull/159
* chore: update example notebooks to pip install the fmeval package by danielezhu in https://github.com/aws/fmeval/pull/158
* fix(pre-launch science review): correcting categories for toxicity da… by franluca in https://github.com/aws/fmeval/pull/136
* fix: replace add_column with map in _generate_prompt_column by danielezhu in https://github.com/aws/fmeval/pull/161
* Update f1 score in QA accuracy eval by bilalaws in https://github.com/aws/fmeval/pull/166
* feat: added the precision and recall metrics for QA accuracy by bilalaws in https://github.com/aws/fmeval/pull/157
* Strip text when computing precision and recall. by bilalaws in https://github.com/aws/fmeval/pull/172
* fix: create single source of truth for dataset column names by danielezhu in https://github.com/aws/fmeval/pull/171
* fix: update Ray to version 2.9.0 by danielezhu in https://github.com/aws/fmeval/pull/173
* chore: update devtool all to install first, lint after by keerthanvasist in https://github.com/aws/fmeval/pull/174
* feat: stringify dataset column contents during data loading by danielezhu in https://github.com/aws/fmeval/pull/168
* fix: unblock release pipeline by xiaoyi-cheng in https://github.com/aws/fmeval/pull/176
* fix: update scores description by xiaoyi-cheng in https://github.com/aws/fmeval/pull/177
* fix: split text by any newline and spaces by franluca in https://github.com/aws/fmeval/pull/178
* fix: load detoxify model from state dict and upgrade transformers version by oyangz in https://github.com/aws/fmeval/pull/180
* fix: Fix example notebook unit tests by danielezhu in https://github.com/aws/fmeval/pull/188
* chore: Update Ray to 2.9.1 by danielezhu in https://github.com/aws/fmeval/pull/189
* chore: remove xsum dataset and update gigaword description by xiaoyi-cheng in https://github.com/aws/fmeval/pull/191
* chore: remove XSUM dataset from example notebook and integration tests by danielezhu in https://github.com/aws/fmeval/pull/192
* feat: add support for non-deterministic models in GeneralSemanticRobustness and add BERTScore Dissimilarity by bilalaws in https://github.com/aws/fmeval/pull/184
* fix: add bert_score_dissimilarity description by oyangz in https://github.com/aws/fmeval/pull/193
* fix: Toxicity evaluate_sample error message by xiaoyi-cheng in https://github.com/aws/fmeval/pull/185
* build(deps): bump aiohttp to fix vulnerability by xiaoyi-cheng in https://github.com/aws/fmeval/pull/194
* build: bump fmeval version to 0.4.0 by xiaoyi-cheng in https://github.com/aws/fmeval/pull/195

New Contributors
* bilalaws made their first contribution in https://github.com/aws/fmeval/pull/166

**Full Changelog**: https://github.com/aws/fmeval/compare/v0.3.0...v0.4.0

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23334