Detections
Analytics
SCA: security update for torchserve (GHSA-8fxr-qfr9-p34w)
critical Tenable Cloud Security Plugin ID 412645
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default
configuration lacks proper input validation, enabling third parties to invoke remote HTTP download
requests and write files to the disk. This issue could be taken advantage of to compromise the integrity
of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load
the model of their choice from any URL that they would like to use. The user of TorchServe is responsible
for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the
user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2
includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
(CVE-2023-43654)
See Also
Plugin Details
Severity: Critical
ID: 412645
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.87
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-43654
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/2/2023
Vulnerability Publication Date: 9/28/2023
Reference Information
CVE: CVE-2023-43654
cwe: CWE-918