Workflow

PyPi: Onnx

CVE-2024-27318

Safety vulnerability ID: 65702

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Feb 23, 2024 Updated at Nov 29, 2024
Scan your Python projects for vulnerabilities →

Advisory

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882. See CVE-2024-27318.

Affected package

onnx

Latest version: 1.17.0

Open Neural Network Exchange

Affected versions

Fixed versions

Vulnerability changelog

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882. See CVE-2024-27318.


MISC:https://github.com/onnx/onnx/commit/66b7fb630903fdcf3e83b6b6d56d82e904264a20: https://github.com/onnx/onnx/commit/66b7fb630903fdcf3e83b6b6d56d82e904264a20
MISC:https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479: https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application