Description (CNA)
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| onnx / onnx | affected < 1.21.0 |
CWE
CWE-23, CWE-61
References
- https://github.com/onnx/onnx/security/advisories/GHSA-3r9x-f23j-gc73
- https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Open Neural Network Exchange (ONNX), an open standard for machine learning interoperability. This path traversal vulnerability, exploitable via a symbolic link (symlink), allows an attacker to read arbitrary files located outside of the intended model or user-provided directories. This could lead to unauthorized information disclosure.