Описание
TorchGeo Remote Code Execution Vulnerability
Impact
TorchGeo 0.4–0.6.0 used an eval statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose torchgeo.models.get_weight() or torchgeo.trainers as an external API could be affected.
Patches
The eval statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer.
Workarounds
In unpatched versions, input validation and sanitization can be used to avoid this vulnerability.
References
Bug history
- Introduced: https://github.com/torchgeo/torchgeo/pull/917
- Patched: https://github.com/torchgeo/torchgeo/pull/2323
- Released: v0.6.1
Ссылки
- https://github.com/torchgeo/torchgeo/security/advisories/GHSA-ghq9-vc6f-8qjf
- https://nvd.nist.gov/vuln/detail/CVE-2024-49048
- https://github.com/torchgeo/torchgeo/pull/2323
- https://github.com/torchgeo/torchgeo/pull/917
- https://github.com/torchgeo/torchgeo/commit/1a980788cb7089a1115f3b786c7daa9dd47d7d7a
- https://github.com/microsoft/torchgeo/releases/tag/v0.6.1
- https://github.com/pypa/advisory-database/tree/main/vulns/torchgeo/PYSEC-2024-204.yaml
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49048
Пакеты
torchgeo
>= 0.4, <= 0.6.0
0.6.1
Связанные уязвимости
Уязвимость библиотеки для работы с геопространственными данными Microsoft TorchGeo, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код