8.2

CVE-2022-0315

Insecure Temporary File in horovod/horovod

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Horovod ≫ Horovod Version < 0.24.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.92% 0.556
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
security@huntr.dev 8.2 3.9 4.2
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-377 Insecure Temporary File

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41
Patch
Third Party Advisory
https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45
Patch
Third Party Advisory
Issue Tracking