Vulnerability	Vulnerable Version
M Use of Incorrectly-Resolved Name or Reference torchserve is a TorchServe is a tool for serving neural net models for inference Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference. This is because the check on `allowed_urls` configuration can be bypassed if the URL contains characters such as `..`, which allows the targeted MAR file to be copied from the source to the model-store folder. Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are unaffected. How to fix Use of Incorrectly-Resolved Name or Reference? Upgrade `torchserve` to version 0.11.0 or higher.	[,0.11.0)
M Exposure of Resource to Wrong Sphere torchserve is a TorchServe is a tool for serving neural net models for inference Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to two gRPC ports 7070 and 7071 that are not bound to localhost by default. Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. How to fix Exposure of Resource to Wrong Sphere? Upgrade `torchserve` to version 0.11.0 or higher.	[0.3.0,0.11.0)

Use of Incorrectly-Resolved Name or Reference

torchserve is a TorchServe is a tool for serving neural net models for inference

Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference. This is because the check on allowed_urls configuration can be bypassed if the URL contains characters such as .., which allows the targeted MAR file to be copied from the source to the model-store folder.

Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are unaffected.

How to fix Use of Incorrectly-Resolved Name or Reference?

Upgrade torchserve to version 0.11.0 or higher.

[,0.11.0)

Exposure of Resource to Wrong Sphere

torchserve is a TorchServe is a tool for serving neural net models for inference

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to two gRPC ports 7070 and 7071 that are not bound to localhost by default.

Note: Users that are using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected.

How to fix Exposure of Resource to Wrong Sphere?

Upgrade torchserve to version 0.11.0 or higher.

[0.3.0,0.11.0)

Go back to all versions of this package