Executive brief
Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.
Affected products
- PyPI onnx
Junglewise Threat Intelligence
CVE-2024-27319: PYSEC-2024-223 - Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions
CVE-2024-27319 · Severity: low · CVSS 3.1 · Published 2024-02-23
Technologies: onnx (PyPI). Vendors: PyPI.
Related threats
- ONNX TOCTOU race condition in save_external_data
- ONNX save_external_data symlink-following file write
- Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_convert
- ONNX null pointer dereference in version_converter
- ONNX TOCTOU arbitrary file write in save_external_data