pysec - pysec-2022-175

pysec-2022-175

Vulnerability from pysec

Published

2022-03-24 09:15

Modified

2022-03-31 20:31

Details

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.

Impacted products

Name	purl
horovod	pkg:pypi/horovod

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "horovod",
        "purl": "pkg:pypi/horovod"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41"
            }
          ],
          "repo": "https://github.com/horovod/horovod",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.0",
        "0.10.1",
        "0.10.2",
        "0.11.0",
        "0.11.1",
        "0.11.2",
        "0.11.3",
        "0.12.0",
        "0.12.1",
        "0.13.0",
        "0.13.1",
        "0.13.10",
        "0.13.11",
        "0.13.2",
        "0.13.3",
        "0.13.4",
        "0.13.5",
        "0.13.6",
        "0.13.7",
        "0.13.8",
        "0.14.0",
        "0.14.1",
        "0.15.0",
        "0.15.1",
        "0.15.2",
        "0.16.0",
        "0.16.1",
        "0.16.2",
        "0.16.3",
        "0.16.4",
        "0.18.0",
        "0.18.1",
        "0.18.2",
        "0.19.0",
        "0.19.1",
        "0.19.2",
        "0.19.3",
        "0.19.4",
        "0.19.5",
        "0.20.0",
        "0.20.1",
        "0.20.2",
        "0.20.3",
        "0.21.0",
        "0.21.1",
        "0.21.2",
        "0.21.3",
        "0.22.0",
        "0.22.1",
        "0.23.0",
        "0.9.0",
        "0.9.1",
        "0.9.10",
        "0.9.11",
        "0.9.12",
        "0.9.2",
        "0.9.3",
        "0.9.4",
        "0.9.5",
        "0.9.6",
        "0.9.7",
        "0.9.8",
        "0.9.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0315",
    "GHSA-47wv-vhj2-g66m"
  ],
  "details": "Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.",
  "id": "PYSEC-2022-175",
  "modified": "2022-03-31T20:31:44.168006Z",
  "published": "2022-03-24T09:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45"
    },
    {
      "type": "FIX",
      "url": "https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-47wv-vhj2-g66m"
    }
  ]
}

CVE-2022-0315 (GCVE-0-2022-0315)

Vulnerability from cvelistv5

Published

2022-03-24 08:30

Modified

2024-08-02 23:25

Severity ?

8.2 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE

CWE-377 - Insecure Temporary File

Summary

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.

References

URL

Tags

	https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45	x_refsource_CONFIRM
	https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	horovod	horovod/horovod	Version: unspecified < 0.24.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:25:40.485Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "horovod/horovod",
          "vendor": "horovod",
          "versions": [
            {
              "lessThan": "0.24.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-377",
              "description": "CWE-377 Insecure Temporary File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-24T08:30:14",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41"
        }
      ],
      "source": {
        "advisory": "7e50397b-dd63-4bb5-b56d-704094a7da45",
        "discovery": "EXTERNAL"
      },
      "title": "Insecure Temporary File in horovod/horovod",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0315",
          "STATE": "PUBLIC",
          "TITLE": "Insecure Temporary File in horovod/horovod"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "horovod/horovod",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.24.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "horovod"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-377 Insecure Temporary File"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45"
            },
            {
              "name": "https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41",
              "refsource": "MISC",
              "url": "https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41"
            }
          ]
        },
        "source": {
          "advisory": "7e50397b-dd63-4bb5-b56d-704094a7da45",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0315",
    "datePublished": "2022-03-24T08:30:14",
    "dateReserved": "2022-01-20T00:00:00",
    "dateUpdated": "2024-08-02T23:25:40.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-47wv-vhj2-g66m

Vulnerability from github

Published

2022-03-29 19:18

Modified

2024-09-20 21:30

Severity ?

8.2 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
8.8 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Summary

Use of insecure temporary file in Horovod

Details

Impact

The insecure tempfile.mktemp() is used when Horovod is run in an LSF job with jsrun. In that situation, a jsrun rank file is created with mktemp, which could be hijacked by another process to read or manipulate the content.

This issue does not impact the use of MPI, Gloo, Spark or Ray.

Patches

The problem has been fixed in b96ecae4.

Workarounds

The rank file is not created when binding_args are provided in the Settings instance.

References

Please see https://github.com/horovod/horovod/pull/3358 for details.

For more information

If you have any questions or comments about this advisory: * Open an issue in https://github.com/horovod/horovod

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "horovod"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0315"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-377",
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-29T19:18:32Z",
    "nvd_published_at": "2022-03-24T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe insecure `tempfile.mktemp()` is used when Horovod is run in an LSF job with `jsrun`. In that situation, a jsrun rank file is created with `mktemp`, which could be hijacked by another process to read or manipulate the content.\n\nThis issue does not impact the use of MPI, Gloo, Spark or Ray.\n\n### Patches\nThe problem has been fixed in [b96ecae4](https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41).\n\n### Workarounds\nThe rank file is not created when `binding_args` are provided in the `Settings` instance.\n\n### References\nPlease see https://github.com/horovod/horovod/pull/3358 for details.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [https://github.com/horovod/horovod](https://github.com/horovod/horovod/issues/new/choose)",
  "id": "GHSA-47wv-vhj2-g66m",
  "modified": "2024-09-20T21:30:25Z",
  "published": "2022-03-29T19:18:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/horovod/horovod/security/advisories/GHSA-47wv-vhj2-g66m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0315"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horovod/horovod/pull/3358"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-47wv-vhj2-g66m"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/horovod/horovod"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/horovod/PYSEC-2022-175.yaml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Use of insecure temporary file in Horovod"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2022-175

Vulnerability from pysec

CVE-2022-0315 (GCVE-0-2022-0315)

Vulnerability from cvelistv5

ghsa-47wv-vhj2-g66m

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

Tags

Sightings

Nomenclature