Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions example2.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
from huggingface_hub import hf_hub_download

hf_hub_download("MIT/ast-finetuned-audioset-10-10-0.4593")

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH  Download of Machine Learning Model Without Integrity Check
    File: example2.py | Checkov ID: CKV3_SAST_99


How To Fix

from huggingface_hub import hf_hub_download

model = hf_hub_download("some_model", revision="specific_commit")


Description

CWE: CWE-494: Download of Code Without Integrity Check
OWASP: A08:2021-Software and Data Integrity Failures

This SAST policy identifies instances where machine learning models are downloaded without specifying a specific revision, which could lead to the use of untrusted or tampered models.

Vulnerable code example:

python
from huggingface_hub import hf_hub_download

model = hf_hub_download("some_model")

In the above example, the hf_hub_download function is used without specifying the revision parameter, which means the model can be updated or tampered with without verification.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH  Download of Machine Learning Model Without Integrity Check
    File: example2.py | Checkov ID: CKV3_SAST_99


How To Fix

from huggingface_hub import hf_hub_download

model = hf_hub_download("some_model", revision="specific_commit")


Description

CWE: CWE-494: Download of Code Without Integrity Check
OWASP: A08:2021-Software and Data Integrity Failures

This SAST policy identifies instances where machine learning models are downloaded without specifying a specific revision, which could lead to the use of untrusted or tampered models.

Vulnerable code example:

python
from huggingface_hub import hf_hub_download

model = hf_hub_download("some_model")

In the above example, the hf_hub_download function is used without specifying the revision parameter, which means the model can be updated or tampered with without verification.


hf_hub_download("MIT/ast-finetuned-audioset-10-10-0.4593", revision=None)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH  Download of Machine Learning Model Without Integrity Check
    File: example2.py | Checkov ID: CKV3_SAST_99


How To Fix

from huggingface_hub import hf_hub_download

model = hf_hub_download("some_model", revision="specific_commit")


Description

CWE: CWE-494: Download of Code Without Integrity Check
OWASP: A08:2021-Software and Data Integrity Failures

This SAST policy identifies instances where machine learning models are downloaded without specifying a specific revision, which could lead to the use of untrusted or tampered models.

Vulnerable code example:

python
from huggingface_hub import hf_hub_download

model = hf_hub_download("some_model")

In the above example, the hf_hub_download function is used without specifying the revision parameter, which means the model can be updated or tampered with without verification.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH  Download of Machine Learning Model Without Integrity Check
    File: example2.py | Checkov ID: CKV3_SAST_99


How To Fix

from huggingface_hub import hf_hub_download

model = hf_hub_download("some_model", revision="specific_commit")


Description

CWE: CWE-494: Download of Code Without Integrity Check
OWASP: A08:2021-Software and Data Integrity Failures

This SAST policy identifies instances where machine learning models are downloaded without specifying a specific revision, which could lead to the use of untrusted or tampered models.

Vulnerable code example:

python
from huggingface_hub import hf_hub_download

model = hf_hub_download("some_model")

In the above example, the hf_hub_download function is used without specifying the revision parameter, which means the model can be updated or tampered with without verification.

138 changes: 138 additions & 0 deletions requirements.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,138 @@
torch==0.4.1

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

torch 0.4.1 / requirements.txt

Total vulnerabilities: 3

Critical: 1 High: 2 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2022-45907 CRITICAL CRITICAL 9.8 1.13.1 Open
CVE-2024-31580 HIGH HIGH 7.5 2.2.0 Open
CVE-2024-31583 HIGH HIGH 7.8 2.2.0 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

torch 0.4.1 / requirements.txt

Total vulnerabilities: 3

Critical: 1 High: 2 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2022-45907 CRITICAL CRITICAL 9.8 1.13.1 Open
CVE-2024-31580 HIGH HIGH 7.5 2.2.0 Open
CVE-2024-31583 HIGH HIGH 7.8 2.2.0 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pysummarization 1.1.9 / requirements.txt

HIGH  Strong Copyleft Licenses (GPL-2.0)

Strong Copyleft Licenses

jsonnet==0.10.0 ; sys.platform != 'win32'
overrides
nltk
spacy==2.0
numpy
numpydoc==0.8.0
scipy
scikit-learn

# Write logs for training visualisation with the Tensorboard application
# Install the Tensorboard application separately (part of tensorflow) to view them.
tensorboardX==1.2

# Required by torch.utils.ffi
cffi==1.11.2

# aws commandline tools for running on Docker remotely.
# second requirement is to get botocore < 1.11, to avoid the below bug
awscli>=1.11.91

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

awscli 1.11.91 / requirements.txt

Total vulnerabilities: 1

Critical: 0 High: 0 Medium: 0 Low: 1
Vulnerability IDSeverityCVSSFixed inStatus
PRISMA-2023-0381 LOW LOW 3.7 1.27.90 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

awscli 1.11.91 / requirements.txt

Total vulnerabilities: 1

Critical: 0 High: 0 Medium: 0 Low: 1
Vulnerability IDSeverityCVSSFixed inStatus
PRISMA-2023-0381 LOW LOW 3.7 1.27.90 Open


# Accessing files from S3 directly.
boto3

# REST interface for models
flask==0.12.4

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

flask 0.12.4 / requirements.txt

Total vulnerabilities: 2

Critical: 0 High: 2 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2019-1010083 HIGH HIGH 7.5 1.0 Open
CVE-2023-30861 HIGH HIGH 7.5 2.2.5 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

flask 0.12.4 / requirements.txt

Total vulnerabilities: 2

Critical: 0 High: 2 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2019-1010083 HIGH HIGH 7.5 1.0 Open
CVE-2023-30861 HIGH HIGH 7.5 2.2.5 Open

flask-cors==3.0.3

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

flask-cors 3.0.3 / requirements.txt

Total vulnerabilities: 3

Critical: 0 High: 2 Medium: 1 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2024-6221 HIGH HIGH 7.5 4.0.2 Open
CVE-2020-25032 HIGH HIGH 7.5 3.0.9 Open
CVE-2024-1681 MEDIUM MEDIUM 5.3 4.0.1 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

flask-cors 3.0.3 / requirements.txt

Total vulnerabilities: 3

Critical: 0 High: 2 Medium: 1 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2024-6221 HIGH HIGH 7.5 4.0.2 Open
CVE-2020-25032 HIGH HIGH 7.5 3.0.9 Open
CVE-2024-1681 MEDIUM MEDIUM 5.3 4.0.1 Open

gevent==1.3.6

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gevent 1.3.6 / requirements.txt

Total vulnerabilities: 1

Critical: 1 High: 0 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2023-41419 CRITICAL CRITICAL 9.8 23.9.0 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gevent 1.3.6 / requirements.txt

Total vulnerabilities: 1

Critical: 1 High: 0 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2023-41419 CRITICAL CRITICAL 9.8 23.9.0 Open


# Used by semantic parsing code to strip diacritics from unicode strings.
unidecode

# Used by semantic parsing code to parse SQL
parsimonious==0.8.0

# Used by semantic parsing code to format and postprocess SQL
sqlparse==0.2.4

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sqlparse 0.2.4 / requirements.txt

Total vulnerabilities: 2

Critical: 0 High: 2 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2023-30608 HIGH HIGH 7.5 0.4.4 Open
CVE-2024-4340 HIGH HIGH 7.5 0.5.0 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sqlparse 0.2.4 / requirements.txt

Total vulnerabilities: 2

Critical: 0 High: 2 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2023-30608 HIGH HIGH 7.5 0.4.4 Open
CVE-2024-4340 HIGH HIGH 7.5 0.5.0 Open


lightning==2.2.1

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lightning 2.2.1 / requirements.txt

Total vulnerabilities: 2

Critical: 2 High: 0 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2024-5452 CRITICAL CRITICAL 9.8 2.3.3 Open
CVE-2024-5980 CRITICAL CRITICAL 9.1 2.3.3 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lightning 2.2.1 / requirements.txt

Total vulnerabilities: 2

Critical: 2 High: 0 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2024-5452 CRITICAL CRITICAL 9.8 2.3.3 Open
CVE-2024-5980 CRITICAL CRITICAL 9.1 2.3.3 Open

tensorflow-cpu==2.10.0

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tensorflow-cpu 2.10.0 / requirements.txt

Total vulnerabilities: 48

Critical: 6 High: 39 Medium: 1 Low: 2
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2022-41880 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2022-41900 CRITICAL CRITICAL 9.8 2.10.1 Open
CVE-2022-41902 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2022-41910 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2023-25664 CRITICAL CRITICAL 9.8 2.12.0 Open
CVE-2023-25668 CRITICAL CRITICAL 9.8 2.12.0 Open
CVE-2023-33976 HIGH HIGH 7.5 2.13.0 Open
CVE-2022-41883 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41884 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41886 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41887 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41888 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41889 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41890 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41891 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41893 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41894 HIGH HIGH 8.1 2.10.1 Open
CVE-2022-41895 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41896 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41897 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41898 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41899 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41901 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41907 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41908 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41909 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41911 HIGH HIGH 7.5 2.10.1 Open
CVE-2023-25658 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25659 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25660 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25662 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25663 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25665 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25666 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25667 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25669 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25670 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25671 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25672 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25673 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25674 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25675 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25676 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25801 HIGH HIGH 7.8 2.12.0 Open
CVE-2023-27579 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25661 MEDIUM MEDIUM 6.5 2.11.1 Open
GHSA-cqvq-fvhr-v6hc LOW LOW 1 2.10.1 Open
GHSA-xf83-q765-xm6m LOW LOW 1 2.10.1 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tensorflow-cpu 2.10.0 / requirements.txt

Total vulnerabilities: 48

Critical: 6 High: 39 Medium: 1 Low: 2
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2022-41880 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2022-41900 CRITICAL CRITICAL 9.8 2.10.1 Open
CVE-2022-41902 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2022-41910 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2023-25664 CRITICAL CRITICAL 9.8 2.12.0 Open
CVE-2023-25668 CRITICAL CRITICAL 9.8 2.12.0 Open
CVE-2023-33976 HIGH HIGH 7.5 2.13.0 Open
CVE-2022-41883 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41884 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41886 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41887 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41888 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41889 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41890 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41891 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41893 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41894 HIGH HIGH 8.1 2.10.1 Open
CVE-2022-41895 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41896 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41897 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41898 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41899 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41901 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41907 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41908 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41909 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41911 HIGH HIGH 7.5 2.10.1 Open
CVE-2023-25658 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25659 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25660 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25662 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25663 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25665 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25666 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25667 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25669 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25670 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25671 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25672 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25673 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25674 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25675 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25676 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25801 HIGH HIGH 7.8 2.12.0 Open
CVE-2023-27579 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25661 MEDIUM MEDIUM 6.5 2.11.1 Open
GHSA-cqvq-fvhr-v6hc LOW LOW 1 2.10.1 Open
GHSA-xf83-q765-xm6m LOW LOW 1 2.10.1 Open

tensorflow-gpu==2.10.0

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tensorflow-gpu 2.10.0 / requirements.txt

Total vulnerabilities: 48

Critical: 6 High: 39 Medium: 1 Low: 2
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2022-41880 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2022-41900 CRITICAL CRITICAL 9.8 2.10.1 Open
CVE-2022-41902 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2022-41910 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2023-25664 CRITICAL CRITICAL 9.8 2.12.0 Open
CVE-2023-25668 CRITICAL CRITICAL 9.8 2.12.0 Open
CVE-2023-33976 HIGH HIGH 7.5 2.13.0 Open
CVE-2022-41883 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41884 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41886 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41887 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41888 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41889 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41890 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41891 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41893 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41894 HIGH HIGH 8.1 2.10.1 Open
CVE-2022-41895 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41896 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41897 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41898 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41899 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41901 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41907 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41908 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41909 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41911 HIGH HIGH 7.5 2.10.1 Open
CVE-2023-25658 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25659 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25660 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25662 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25663 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25665 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25666 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25667 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25669 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25670 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25671 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25672 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25673 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25674 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25675 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25676 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25801 HIGH HIGH 7.8 2.12.0 Open
CVE-2023-27579 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25661 MEDIUM MEDIUM 6.5 2.11.1 Open
GHSA-cqvq-fvhr-v6hc LOW LOW 1 2.10.1 Open
GHSA-xf83-q765-xm6m LOW LOW 1 2.10.1 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tensorflow-gpu 2.10.0 / requirements.txt

Total vulnerabilities: 48

Critical: 6 High: 39 Medium: 1 Low: 2
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2022-41880 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2022-41900 CRITICAL CRITICAL 9.8 2.10.1 Open
CVE-2022-41902 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2022-41910 CRITICAL CRITICAL 9.1 2.10.1 Open
CVE-2023-25664 CRITICAL CRITICAL 9.8 2.12.0 Open
CVE-2023-25668 CRITICAL CRITICAL 9.8 2.12.0 Open
CVE-2023-33976 HIGH HIGH 7.5 2.13.0 Open
CVE-2022-41883 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41884 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41886 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41887 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41888 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41889 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41890 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41891 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41893 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41894 HIGH HIGH 8.1 2.10.1 Open
CVE-2022-41895 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41896 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41897 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41898 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41899 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41901 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41907 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41908 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41909 HIGH HIGH 7.5 2.10.1 Open
CVE-2022-41911 HIGH HIGH 7.5 2.10.1 Open
CVE-2023-25658 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25659 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25660 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25662 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25663 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25665 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25666 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25667 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25669 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25670 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25671 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25672 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25673 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25674 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25675 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25676 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25801 HIGH HIGH 7.8 2.12.0 Open
CVE-2023-27579 HIGH HIGH 7.5 2.12.0 Open
CVE-2023-25661 MEDIUM MEDIUM 6.5 2.11.1 Open
GHSA-cqvq-fvhr-v6hc LOW LOW 1 2.10.1 Open
GHSA-xf83-q765-xm6m LOW LOW 1 2.10.1 Open

langchain==0.0.350

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

langchain 0.0.350 / requirements.txt

Total vulnerabilities: 4

Critical: 0 High: 0 Medium: 2 Low: 2
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2024-2965 MEDIUM MEDIUM 4.2 0.2.5 Open
CVE-2024-3571 MEDIUM MEDIUM 6.5 0.0.353 Open
CVE-2024-8309 LOW LOW 4.9 0.2.0 Open
CVE-2024-0243 LOW LOW 3.7 0.1.0 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

langchain 0.0.350 / requirements.txt

Total vulnerabilities: 4

Critical: 0 High: 0 Medium: 2 Low: 2
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2024-2965 MEDIUM MEDIUM 4.2 0.2.5 Open
CVE-2024-3571 MEDIUM MEDIUM 6.5 0.0.353 Open
CVE-2024-8309 LOW LOW 4.9 0.2.0 Open
CVE-2024-0243 LOW LOW 3.7 0.1.0 Open

aisploit==0.0.25
goldenretriever-core==1.0.0
pysummarization==1.1.9
animalai-train==2.0.0
vectorai-nightly==0.2.5.2021.6.2

# For text normalization
ftfy

#### ESSENTIAL LIBRARIES USED IN SCRIPTS ####

# Plot graphs for learning rate finder
matplotlib==2.2.3

# Used for downloading datasets over HTTP
requests>=2.18

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

requests 2.18 / requirements.txt

Total vulnerabilities: 3

Critical: 0 High: 1 Medium: 2 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2018-18074 HIGH HIGH 7.5 2.20.0 Open
CVE-2023-32681 MEDIUM MEDIUM 6.1 2.31.0 Open
CVE-2024-35195 MEDIUM MEDIUM 5.6 2.32.0 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

requests 2.18 / requirements.txt

Total vulnerabilities: 3

Critical: 0 High: 1 Medium: 2 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2018-18074 HIGH HIGH 7.5 2.20.0 Open
CVE-2023-32681 MEDIUM MEDIUM 6.1 2.31.0 Open
CVE-2024-35195 MEDIUM MEDIUM 5.6 2.32.0 Open


# progress bars in data cleaning scripts
tqdm>=4.19

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tqdm 4.19 / requirements.txt

Total vulnerabilities: 1

Critical: 0 High: 0 Medium: 0 Low: 1
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2024-34062 LOW LOW 3.9 4.66.3 Open

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tqdm 4.19 / requirements.txt

Total vulnerabilities: 1

Critical: 0 High: 0 Medium: 0 Low: 1
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2024-34062 LOW LOW 3.9 4.66.3 Open


# In SQuAD eval script, we use this to see if we likely have some tokenization problem.
editdistance

# For pretrained model weights
h5py

# For timezone utilities
pytz==2017.3

# Reads Universal Dependencies files.
conllu==0.11

#### ESSENTIAL TESTING-RELATED PACKAGES ####

# We'll use pytest to run our tests; this isn't really necessary to run the code, but it is to run
# the tests. With this here, you can run the tests with `py.test` from the base directory.
pytest

# Allows marking tests as flaky, to be rerun if they fail
flaky

# Required to mock out `requests` calls
responses>=0.7

# For mocking s3.
moto==1.3.4

#### TESTING-RELATED PACKAGES ####

# Checks style, syntax, and other useful errors.
pylint==1.8.1

# Tutorial notebooks
# see: https://github.com/jupyter/jupyter/issues/370 for ipykernel
ipykernel<5.0.0
jupyter

# Static type checking
mypy==0.521

# Allows generation of coverage reports with pytest.
pytest-cov

# Allows codecov to generate coverage reports
coverage
codecov

# Required to run sanic tests
aiohttp

#### DOC-RELATED PACKAGES ####

# Builds our documentation.
sphinx==1.5.3

# Watches the documentation directory and rebuilds on changes.
sphinx-autobuild

# doc theme
sphinx_rtd_theme

# Only used to convert our readme to reStructuredText on Pypi.
pypandoc

# Pypi uploads
twine==1.11.0

#### GENERATOR-RELATED PACKAGES ####

# Used by AddSent.
psutil
pattern

# Used by SWAG.
allennlp
num2words
3 changes: 3 additions & 0 deletions test.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
import torch

torch.hub.download_url_to_file("https://example.com", "/tmp/unsafe", hash_prefix=None)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM  Missing hash check in PyTorch
    File: test.py | Checkov ID: CKV3_SAST_194


How To Fix

import torch

Downloading a file with hash verification

torch.hub.download_url_to_file('https://example.com/model.pth', 'model.pth', hash_prefix='1234567890abcdef')

Loading a model state dictionary with hash check

state_dict = torch.hub.load_state_dict_from_url('https://example.com/model.pth', check_hash=True)

Loading a model using model_zoo with hash check

model = torch.utils.model_zoo.load_url('https://example.com/model.pth', check_hash=True)


Description

CWE: CWE-347: Improper Verification of Cryptographic Signature
OWASP: A02:2021-Cryptographic Failures

This policy detects whether PyTorch functions are used to load remote files without hash verification. Downloading untrusted files without validating their hashes exposes applications to security risks, such as executing malicious code. Using the hash_prefix or check_hash arguments is crucial to ensure the integrity of downloaded files.

In this example, files are downloaded and loaded without any hash verification, exposing the application to potential security risks.

Python
import torch

# Downloading a file without hash verification
torch.hub.download_url_to_file('https://example.com/model.pth', 'model.pth')

# Loading a model state dictionary without hash check
state_dict = torch.hub.load_state_dict_from_url('https://example.com/model.pth')

# Loading a model using model_zoo without hash check
model = torch.utils.model_zoo.load_url('https://example.com/model.pth')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM  Missing hash check in PyTorch
    File: test.py | Checkov ID: CKV3_SAST_194


How To Fix

import torch

Downloading a file with hash verification

torch.hub.download_url_to_file('https://example.com/model.pth', 'model.pth', hash_prefix='1234567890abcdef')

Loading a model state dictionary with hash check

state_dict = torch.hub.load_state_dict_from_url('https://example.com/model.pth', check_hash=True)

Loading a model using model_zoo with hash check

model = torch.utils.model_zoo.load_url('https://example.com/model.pth', check_hash=True)


Description

CWE: CWE-347: Improper Verification of Cryptographic Signature
OWASP: A02:2021-Cryptographic Failures

This policy detects whether PyTorch functions are used to load remote files without hash verification. Downloading untrusted files without validating their hashes exposes applications to security risks, such as executing malicious code. Using the hash_prefix or check_hash arguments is crucial to ensure the integrity of downloaded files.

In this example, files are downloaded and loaded without any hash verification, exposing the application to potential security risks.

Python
import torch

# Downloading a file without hash verification
torch.hub.download_url_to_file('https://example.com/model.pth', 'model.pth')

# Loading a model state dictionary without hash check
state_dict = torch.hub.load_state_dict_from_url('https://example.com/model.pth')

# Loading a model using model_zoo without hash check
model = torch.utils.model_zoo.load_url('https://example.com/model.pth')