mirror of
https://github.com/openai/CLIP.git
synced 2026-11-05 01:37:26 +00:00
[GH-ISSUE #333] Pytorch 1.7 contains vulnerability that is fixed in upgraded version #287
Labels
No labels
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
openai/CLIP#287
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cprocak3 on GitHub (Mar 6, 2023).
Original GitHub issue: https://github.com/openai/CLIP/issues/333
Hello,
Pytorch 1.7 has a vulnerability that can cause an arbitrary code execution when used. It is fixed in version 1.13.1. When can it be expected for Pytorch to be upgraded to a more recent version?
See the following for the details on the CVE:
https://avd.aquasec.com/nvd/2022/cve-2022-45907/
@jongwook commented on GitHub (Mar 6, 2023):
Hi, I see the relevant issue is this one, and the vulnerability happens when JIT-compiling a module that contains function calls using the Python type hint syntax. While the released CLIP models are using the JIT-compiled format, I don't think any code paths used in this repo is vulnerable to this CVE. (happy to stand corrected though)
In any case, this package does not enforce a specific pytorch version, but I haven't tested if it's source-compatible with 1.13.1 (I'm guessing it is). We can consider adding a warning message if the pytorch version used is too old, but any security implications will ultimately be the responsibility of the entity using this library to deploy their services which may cause arbitrary code execution. See also the LICENSE.