GHSA-4q2w-rw7m-xqw6

Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10844

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	nnabla	< 1.0.10	1.0.10

Details

As written in the advisory (Markdown source, shown as plain text).

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) prior to v1.0.10 relies on the HOME environment variable, which might be untrusted.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10844 advisory
https://github.com/sony/nnabla/issues/209 web
https://github.com/sony/nnabla/pull/299 web
https://github.com/sony/nnabla/commit/e87347648ab7210529a0e60f0849680de8e9b63a web
https://github.com/advisories/GHSA-4q2w-rw7m-xqw6 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/nnabla/PYSEC-2019-107.yaml web
https://github.com/sony/nnabla package
https://github.com/sony/nnabla/releases/tag/v1.0.10 web