CVE-2018-1281

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-1281
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1281.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-1281
Published
2018-06-08T19:29:00Z
Modified
2026-08-27T08:15:25Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI and DMLC_PS_ROOT_PORT env variables. In versions older than 1.0.0, however, the MXNet framework will listen on 0.0.0.0 rather than user specified DMLC_PS_ROOT_URI once a scheduler node is initialized. This exposes the instance running MXNet to any attackers reachable via the interface they didn't expect to be listening on. For example: If a user wants to run a clustered setup locally, they may specify to run on 127.0.0.1. But since MXNet will listen on 0.0.0.0, it makes the port accessible on all network interfaces.

References

Affected packages

Git / github.com/apache/mxnet

Affected ranges

Type
GIT
Repo
https://github.com/apache/mxnet
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
25720d0e3c29232a37e2650f3ba3a2454f9367bb
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:apache:mxnet:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.0.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

v0.*
v0.10.0
v0.7.0
v0.8.0
v0.9.1
v0.9.2
v0.9.3
v0.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1281.json"

Git / github.com/dmlc/ps-lite

Affected ranges

Type
GIT
Repo
https://github.com/dmlc/ps-lite
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4be817e8b03e7e92517e91f2dfcc50865e91c6ea
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

Other
v1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1281.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "120897539249144181966431496770661025315",
                "299990389390380498689687703070480517642",
                "241052016591881057603990671576294435298",
                "173106795815000665197339335555416545990"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2018-1281-65bc9758",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dmlc/ps-lite/commit/4be817e8b03e7e92517e91f2dfcc50865e91c6ea",
        "target":  {
            "file":  "src/zmq_van.h"
        }
    }
]
vanir_signatures_modified 
"2026-08-27T08:15:25Z"