Skip to content

Commit 7b0a06a

Browse files
zhuofuAMZzhuofuAMZ
authored
Move torch and libxml2 away from common allowlist (#4768)
* Move torch and libxml2 away from common allowlist * add missing file
1 parent 4765b5e commit 7b0a06a

19 files changed

+862
-60
lines changed

‎data/common-ecr-scan-allowlist.json‎

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -238,65 +238,5 @@
238238
"title": "CVE-2025-32434 - torch",
239239
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
240240
}
241-
],
242-
"libxml2": [
243-
{
244-
"description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.",
245-
"vulnerability_id": "CVE-2025-32415",
246-
"name": "CVE-2025-32415",
247-
"package_name": "libxml2",
248-
"package_details": {
249-
"file_path": null,
250-
"name": "libxml2",
251-
"package_manager": "OS",
252-
"version": "2.9.13+dfsg",
253-
"release": "1ubuntu0.6"
254-
},
255-
"remediation": {
256-
"recommendation": {
257-
"text": "None Provided"
258-
}
259-
},
260-
"cvss_v3_score": 7.5,
261-
"cvss_v30_score": 0.0,
262-
"cvss_v31_score": 7.5,
263-
"cvss_v2_score": 0.0,
264-
"cvss_v3_severity": "HIGH",
265-
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-32415.html",
266-
"source": "UBUNTU_CVE",
267-
"severity": "HIGH",
268-
"status": "ACTIVE",
269-
"title": "CVE-2025-32415 - libxml2",
270-
"reason_to_ignore": "N/A"
271-
},
272-
{
273-
"description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.",
274-
"vulnerability_id": "CVE-2025-32414",
275-
"name": "CVE-2025-32414",
276-
"package_name": "libxml2",
277-
"package_details": {
278-
"file_path": null,
279-
"name": "libxml2",
280-
"package_manager": "OS",
281-
"version": "2.9.13+dfsg",
282-
"release": "1ubuntu0.6"
283-
},
284-
"remediation": {
285-
"recommendation": {
286-
"text": "None Provided"
287-
}
288-
},
289-
"cvss_v3_score": 7.5,
290-
"cvss_v30_score": 0.0,
291-
"cvss_v31_score": 7.5,
292-
"cvss_v2_score": 0.0,
293-
"cvss_v3_severity": "HIGH",
294-
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-32414.html",
295-
"source": "UBUNTU_CVE",
296-
"severity": "HIGH",
297-
"status": "ACTIVE",
298-
"title": "CVE-2025-32414 - libxml2",
299-
"reason_to_ignore": "N/A"
300-
}
301241
]
302242
}

‎pytorch/inference/docker/2.4/py3/Dockerfile.ec2.cpu.os_scan_allowlist.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2438,5 +2438,36 @@
24382438
"title": "CVE-2024-41073 - linux, linux-libc-dev",
24392439
"reason_to_ignore": "N/A"
24402440
}
2441+
],
2442+
"torch": [
2443+
{
2444+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
2445+
"vulnerability_id": "CVE-2025-32434",
2446+
"name": "CVE-2025-32434",
2447+
"package_name": "torch",
2448+
"package_details": {
2449+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
2450+
"name": "torch",
2451+
"package_manager": "PYTHON",
2452+
"version": "2.4.0+cpu",
2453+
"release": null
2454+
},
2455+
"remediation": {
2456+
"recommendation": {
2457+
"text": "None Provided"
2458+
}
2459+
},
2460+
"cvss_v3_score": 0.0,
2461+
"cvss_v30_score": 0.0,
2462+
"cvss_v31_score": 0.0,
2463+
"cvss_v2_score": 0.0,
2464+
"cvss_v3_severity": "CRITICAL",
2465+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
2466+
"source": "NVD",
2467+
"severity": "CRITICAL",
2468+
"status": "ACTIVE",
2469+
"title": "CVE-2025-32434 - torch",
2470+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
2471+
}
24412472
]
24422473
}

‎pytorch/inference/docker/2.4/py3/Dockerfile.sagemaker.cpu.os_scan_allowlist.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -625,5 +625,36 @@
625625
"title": "CVE-2024-44998 - linux",
626626
"reason_to_ignore": "N/A"
627627
}
628+
],
629+
"torch": [
630+
{
631+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
632+
"vulnerability_id": "CVE-2025-32434",
633+
"name": "CVE-2025-32434",
634+
"package_name": "torch",
635+
"package_details": {
636+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
637+
"name": "torch",
638+
"package_manager": "PYTHON",
639+
"version": "2.4.0+cpu",
640+
"release": null
641+
},
642+
"remediation": {
643+
"recommendation": {
644+
"text": "None Provided"
645+
}
646+
},
647+
"cvss_v3_score": 0.0,
648+
"cvss_v30_score": 0.0,
649+
"cvss_v31_score": 0.0,
650+
"cvss_v2_score": 0.0,
651+
"cvss_v3_severity": "CRITICAL",
652+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
653+
"source": "NVD",
654+
"severity": "CRITICAL",
655+
"status": "ACTIVE",
656+
"title": "CVE-2025-32434 - torch",
657+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
658+
}
628659
]
629660
}

‎pytorch/inference/docker/2.4/py3/cu124/Dockerfile.ec2.gpu.os_scan_allowlist.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2438,5 +2438,36 @@
24382438
"title": "CVE-2024-41011 - linux-libc-dev, linux",
24392439
"reason_to_ignore": "N/A"
24402440
}
2441+
],
2442+
"torch": [
2443+
{
2444+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
2445+
"vulnerability_id": "CVE-2025-32434",
2446+
"name": "CVE-2025-32434",
2447+
"package_name": "torch",
2448+
"package_details": {
2449+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
2450+
"name": "torch",
2451+
"package_manager": "PYTHON",
2452+
"version": "2.4.0+cpu",
2453+
"release": null
2454+
},
2455+
"remediation": {
2456+
"recommendation": {
2457+
"text": "None Provided"
2458+
}
2459+
},
2460+
"cvss_v3_score": 0.0,
2461+
"cvss_v30_score": 0.0,
2462+
"cvss_v31_score": 0.0,
2463+
"cvss_v2_score": 0.0,
2464+
"cvss_v3_severity": "CRITICAL",
2465+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
2466+
"source": "NVD",
2467+
"severity": "CRITICAL",
2468+
"status": "ACTIVE",
2469+
"title": "CVE-2025-32434 - torch",
2470+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
2471+
}
24412472
]
24422473
}

‎pytorch/inference/docker/2.4/py3/cu124/Dockerfile.sagemaker.gpu.os_scan_allowlist.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -625,5 +625,36 @@
625625
"title": "CVE-2024-41070 - linux",
626626
"reason_to_ignore": "N/A"
627627
}
628+
],
629+
"torch": [
630+
{
631+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
632+
"vulnerability_id": "CVE-2025-32434",
633+
"name": "CVE-2025-32434",
634+
"package_name": "torch",
635+
"package_details": {
636+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
637+
"name": "torch",
638+
"package_manager": "PYTHON",
639+
"version": "2.4.0+cpu",
640+
"release": null
641+
},
642+
"remediation": {
643+
"recommendation": {
644+
"text": "None Provided"
645+
}
646+
},
647+
"cvss_v3_score": 0.0,
648+
"cvss_v30_score": 0.0,
649+
"cvss_v31_score": 0.0,
650+
"cvss_v2_score": 0.0,
651+
"cvss_v3_severity": "CRITICAL",
652+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
653+
"source": "NVD",
654+
"severity": "CRITICAL",
655+
"status": "ACTIVE",
656+
"title": "CVE-2025-32434 - torch",
657+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
658+
}
628659
]
629660
}

‎pytorch/inference/docker/2.5/py3/Dockerfile.ec2.cpu.os_scan_allowlist.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,36 @@
2929
"title": "CVE-2025-27363 - libfreetype6",
3030
"reason_to_ignore": "N/A"
3131
}
32+
],
33+
"torch": [
34+
{
35+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
36+
"vulnerability_id": "CVE-2025-32434",
37+
"name": "CVE-2025-32434",
38+
"package_name": "torch",
39+
"package_details": {
40+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
41+
"name": "torch",
42+
"package_manager": "PYTHON",
43+
"version": "2.4.0+cpu",
44+
"release": null
45+
},
46+
"remediation": {
47+
"recommendation": {
48+
"text": "None Provided"
49+
}
50+
},
51+
"cvss_v3_score": 0.0,
52+
"cvss_v30_score": 0.0,
53+
"cvss_v31_score": 0.0,
54+
"cvss_v2_score": 0.0,
55+
"cvss_v3_severity": "CRITICAL",
56+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
57+
"source": "NVD",
58+
"severity": "CRITICAL",
59+
"status": "ACTIVE",
60+
"title": "CVE-2025-32434 - torch",
61+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
62+
}
3263
]
3364
}

‎pytorch/inference/docker/2.5/py3/Dockerfile.sagemaker.cpu.os_scan_allowlist.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,36 @@
2929
"title": "CVE-2025-27363 - libfreetype6",
3030
"reason_to_ignore": "N/A"
3131
}
32+
],
33+
"torch": [
34+
{
35+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
36+
"vulnerability_id": "CVE-2025-32434",
37+
"name": "CVE-2025-32434",
38+
"package_name": "torch",
39+
"package_details": {
40+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
41+
"name": "torch",
42+
"package_manager": "PYTHON",
43+
"version": "2.4.0+cpu",
44+
"release": null
45+
},
46+
"remediation": {
47+
"recommendation": {
48+
"text": "None Provided"
49+
}
50+
},
51+
"cvss_v3_score": 0.0,
52+
"cvss_v30_score": 0.0,
53+
"cvss_v31_score": 0.0,
54+
"cvss_v2_score": 0.0,
55+
"cvss_v3_severity": "CRITICAL",
56+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
57+
"source": "NVD",
58+
"severity": "CRITICAL",
59+
"status": "ACTIVE",
60+
"title": "CVE-2025-32434 - torch",
61+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
62+
}
3263
]
3364
}

‎pytorch/inference/docker/2.5/py3/cu124/Dockerfile.ec2.gpu.os_scan_allowlist.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,36 @@
2929
"title": "CVE-2025-27363 - libfreetype6",
3030
"reason_to_ignore": "N/A"
3131
}
32+
],
33+
"torch": [
34+
{
35+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
36+
"vulnerability_id": "CVE-2025-32434",
37+
"name": "CVE-2025-32434",
38+
"package_name": "torch",
39+
"package_details": {
40+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
41+
"name": "torch",
42+
"package_manager": "PYTHON",
43+
"version": "2.4.0+cpu",
44+
"release": null
45+
},
46+
"remediation": {
47+
"recommendation": {
48+
"text": "None Provided"
49+
}
50+
},
51+
"cvss_v3_score": 0.0,
52+
"cvss_v30_score": 0.0,
53+
"cvss_v31_score": 0.0,
54+
"cvss_v2_score": 0.0,
55+
"cvss_v3_severity": "CRITICAL",
56+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
57+
"source": "NVD",
58+
"severity": "CRITICAL",
59+
"status": "ACTIVE",
60+
"title": "CVE-2025-32434 - torch",
61+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
62+
}
3263
]
3364
}

‎pytorch/inference/docker/2.5/py3/cu124/Dockerfile.sagemaker.gpu.os_scan_allowlist.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,36 @@
2929
"title": "CVE-2025-27363 - libfreetype6",
3030
"reason_to_ignore": "N/A"
3131
}
32+
],
33+
"torch": [
34+
{
35+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
36+
"vulnerability_id": "CVE-2025-32434",
37+
"name": "CVE-2025-32434",
38+
"package_name": "torch",
39+
"package_details": {
40+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
41+
"name": "torch",
42+
"package_manager": "PYTHON",
43+
"version": "2.4.0+cpu",
44+
"release": null
45+
},
46+
"remediation": {
47+
"recommendation": {
48+
"text": "None Provided"
49+
}
50+
},
51+
"cvss_v3_score": 0.0,
52+
"cvss_v30_score": 0.0,
53+
"cvss_v31_score": 0.0,
54+
"cvss_v2_score": 0.0,
55+
"cvss_v3_severity": "CRITICAL",
56+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
57+
"source": "NVD",
58+
"severity": "CRITICAL",
59+
"status": "ACTIVE",
60+
"title": "CVE-2025-32434 - torch",
61+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
62+
}
3263
]
3364
}

‎pytorch/training/docker/2.4/py3/Dockerfile.ec2.cpu.os_scan_allowlist.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"torch": [
3+
{
4+
"description": "PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.",
5+
"vulnerability_id": "CVE-2025-32434",
6+
"name": "CVE-2025-32434",
7+
"package_name": "torch",
8+
"package_details": {
9+
"file_path": "/opt/conda/lib/python3.11/site-packages/torch-2.4.0+cpu.dist-info/METADATA",
10+
"name": "torch",
11+
"package_manager": "PYTHON",
12+
"version": "2.4.0+cpu",
13+
"release": null
14+
},
15+
"remediation": {
16+
"recommendation": {
17+
"text": "None Provided"
18+
}
19+
},
20+
"cvss_v3_score": 0.0,
21+
"cvss_v30_score": 0.0,
22+
"cvss_v31_score": 0.0,
23+
"cvss_v2_score": 0.0,
24+
"cvss_v3_severity": "CRITICAL",
25+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32434",
26+
"source": "NVD",
27+
"severity": "CRITICAL",
28+
"status": "ACTIVE",
29+
"title": "CVE-2025-32434 - torch",
30+
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
31+
}
32+
]
33+
}

0 commit comments

Comments
 (0)