GHSA-3x5x-fw77-g54c
GHSA-3x5x-fw77-g54c · dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()
This page contains facts from public vulnerability sources. Check the original advisory before updating.
### Impact Dgl implements rpc server (start_server() in rpc_server.py) for supporting the RPC communications among different remote users over networks. It relies on pickle serialize and deserialize to pack and unpack network messages. The is a known risk in pickle deserialization functionality that can be used for remote code execution. ### Patches TBD. ### Workarounds When running DGL distributed training and inference (DistDGL) make sure you do not assign public IPs to any instance in the cluster. ### References Issue #7874 ### Reported by Pinji Chen ([[email protected]](mailto:[email protected])) from NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University
CVSS 9.3 · Critical
- Published
- Updated
Stack: python
Affected products and versions
dgl PyPI
- Versions
- 0.0.1
- 0.1.0
- 0.1.2
- 0.1.3
- 0.2
- 0.3
- 0.3.1
- 0.4
- 0.4.1
- 0.4.2
- 0.4.3
- 0.4.3.post1
- 0.4.3.post2
- 0.4rc190819
- 0.4rc190821
- 0.4rc190822
- 0.4rc190823
- 0.4rc190824
- 0.4rc190826
- 0.4rc190902
- 0.4rc190903
- 0.4rc190904
- 0.4rc190905
- 0.4rc190906
- 0.4rc190908
- 0.4rc190909
- 0.4rc190910
- 0.4rc190911
- 0.4rc190912
- 0.4rc190915
- 0.4rc190916
- 0.4rc190917
- 0.4rc190918
- 0.4rc190920
- 0.4rc190921
- 0.4rc190923
- 0.4rc190924
- 0.4rc190927
- 0.4rc190928
- 0.4rc190929
- 0.4rc191001
- 0.4rc191003
- 0.4rc191004
- 0.4rc191005
- 0.5.0
- 0.5.1
- 0.5.2
- 0.5.3
- 0.6.0
- 0.6.0.post1
- 0.6.1
- 0.8.0.post1
- 0.9.0
- 0.9.1
- 1.0.0
- 1.0.1
- 1.0.4
- 1.1.0
- 1.1.1
- 1.1.2
- 1.1.2.post1
- 1.1.3
- 2.0.0
- 2.1.0
- 2.2.0
- 2.2.1
- Affected ranges
- ECOSYSTEM: ≤ 2.4.0
No fix published