VDB
CVE-2024-37902
CVE-2024-37902
PUBLISHED
CVSS 10 CRITICAL
DeepJavaLibrary API absolute path traversal
EPSS 0.78% · 54.7th percentile
Risk Scores
CVSS 3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
0.78%
54.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| deepjavalibrary | djl | >= 0.1.0, < 0.28.0, >= 0.1.0, < 0.28.0 |
| Maven | ai.djl:api | 0.1.0, 0.1.0, 0.1.0 |
| deepjavalibrary | djl | 0.1.0, 0.1.0 |
Timeline
- Jan 21, 1970 Security Advisory
- Jun 17, 2024 CVE Published
- Jun 18, 2024 EPSS Score
- Jun 18, 2024 PoC Published
- Jul 11, 2024 EPSS Score
- Aug 4, 2024 EPSS Score
- Aug 27, 2024 EPSS Score
- Sep 20, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 13, 2024 EPSS Score
- Nov 6, 2024 EPSS Score
- Nov 29, 2024 EPSS Score
References
- https://github.com/aws/deep-learning-containers/releases/tag/v1.4-djl-0.27.0-inf-trt-0.8.0 url
- https://github.com/deepjavalibrary/djl/security/advisories/GHSA-w877-jfw7-46rj technical
- https://github.com/aws/deep-learning-containers/releases/tag/v1.1-djl-0.27.0-inf-cpu-full url
- https://github.com/deepjavalibrary/djl package
- https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0 url
- https://nvd.nist.gov/vuln/detail/CVE-2024-37902 advisory
- https://github.com/aws/deep-learning-containers/releases/tag/v1.3-djl-0.27.0-inf-neuronx-sdk2.18.1 url
- https://github.com/aws/deep-learning-containers/releases/tag/v1.4-djl-0.27.0-inf-ds-0.12.6 url