GHSA-83g7-8fch-p37m

Source
https://github.com/advisories/GHSA-83g7-8fch-p37m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-83g7-8fch-p37m/GHSA-83g7-8fch-p37m.json
Aliases
Published
2022-11-26T03:30:27Z
Modified
2023-11-08T04:10:54.247844Z
Details

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.

References

Affected packages

PyPI / paddlepaddle

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
2.4

Affected versions

1.*

1.8.5

2.*

2.0.0b0
2.0.0rc0
2.0.0rc1
2.0.0
2.0.1
2.0.2
2.1.0
2.1.1
2.1.2
2.1.3
2.2.0rc0
2.2.0
2.2.1
2.2.2
2.3.0rc0
2.3.0
2.3.1
2.3.2
2.4.0rc0