Skip to content
AI Sec Watch
MediumVulnerability

CVE-2024-6577: pytorch/serve upload script references unclaimed S3 bucket

Source
NVD(opens in a new tab)
Identifier
CVE-2024-6577
Published
Record updated
View JSON
Affected
  • torchserve <= 0.11.0
Fixed in
No fixed version was stated when the source was last read.
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.4%

Summary

CVE-2024-6577 affects the latest version of pytorch/serve. The script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without verifying that the bucket is owned or accessible by the project. If the bucket is unsecured or unclaimed by the appropriate entity, this could allow unauthorized access, data breaches, exposure of proprietary information, or unauthorized modification of stored data. The weakness is classified as CWE-840 (Business Logic Errors).

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.