Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data     field of the tensor proto can have a path to the file which is outside the model current directory or     user-provided directory, for example ../../../etc/passwd (CVE-2022-25882)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data
    field of the tensor proto can have a path to the file which is outside the model current directory or
    user-provided directory, for example "../../../etc/passwd" (CVE-2022-25882)

The version of pytorch installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-25882 advisory.

  - Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data     field of the tensor proto can have a path to the file which is outside the model current directory or     user-provided directory, for example ../../../etc/passwd (CVE-2022-25882)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
262445	Linux Distros Unpatched Vulnerability : CVE-2022-25882	Nessus	Misc.	high
414488	SCA: security update for onnx (GHSA-ffxj-547x-5j7c)	Tenable Cloud Security	SCA Checks	high
414488	SCA: security update for onnx (GHSA-ffxj-547x-5j7c)	Tenable Self-Hosted Container Security	SCA Checks	high
174545	CBL Mariner 2.0 Security Update: pytorch (CVE-2022-25882)	Nessus	MarinerOS Local Security Checks	high

Detections

Analytics

CVE-2022-25882

high

Tenable Plugins

high

high

high

high