MediumVulnerability
CVE-2019-10844: Sony Neural Network Libraries (nnabla) trusts HOME environment variable
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2019-10844
- Published
- Record updated
- Affected
- nnabla < 1.0.10
- Fixed in
- 1.0.10
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.6%
Summary
CVE-2019-10844 affects nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14. The component relies on the HOME environment variable, which might be untrusted. NVD has not yet provided an assessment, and the weakness is classified as NVD-CWE-noinfo (Insufficient Information).
Mitigation
The source text references a patch at https://github.com/sony/nnabla/issues/209, but does not state the fix or a fixed version.