dmlc gluon-cv up to 0.10.0 ImageClassificationDataset.from_csv link following

Summaryinfo

A vulnerability marked as problematic has been reported in dmlc gluon-cv up to 0.10.0. This impacts the function ImageClassificationDataset.from_csv. The manipulation leads to input validation. This vulnerability is listed as CVE-2024-12216. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability was found in dmlc gluon-cv up to 0.10.0 and classified as problematic. This issue affects the function ImageClassificationDataset.from_csv. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Impacted is integrity, and availability. The summary by CVE is:

A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.

The advisory is shared at huntr.com. The identification of this vulnerability is CVE-2024-12216 since 12/04/2024. The exploitation is known to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• dmlc

Name

• gluon-cv

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion