Vulnerability · Published Jun 17, 2024 · Assigned by GitHub_M

CVE-2024-37902Path thraversal in DeepJavaLibrary

Critical 10.0

In plain English

A critical-severity path traversal in djl from deepjavalibrary. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.8%top 43.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	ai.djl:api	0.28.0	GHSA-w877-jfw7-46rj

Affected products (as reported)

Vendor	Product	Versions
deepjavalibrary	djl	>= 0.1.0, < 0.28.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj x_refsource_CONFIRM
https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0 x_refsource_MISC