CVE-2022-46742: Code Injection

Q: What is CVE-2022-46742?

CVE-2022-46742 is a code injection vulnerability in PaddlePaddle 2.4.0-rc0 that allows arbitrary code execution.

Q: What software versions are affected by CVE-2022-46742?

PaddlePaddle 2.4.0-rc0 is affected by CVE-2022-46742.

Q: How severe is CVE-2022-46742?

CVE-2022-46742 has a severity score of 9.8 (critical).

Q: Is there a patch available for CVE-2022-46742?

Yes, a patch is available on the develop branch of the PaddlePaddle repository.

Q: Where can I find more information about CVE-2022-46742?

You can find more information about CVE-2022-46742 in the PaddlePaddle repository and the National Vulnerability Database (NVD).

Published Dec 7, 2022

Updated

Code injection in paddle.audio.functional.getwindow in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. A patch is available on the develop branch of the repository and anticipated to be part of a 2.4 release.

Other sources

Code injection in paddle.audio.functional.getwindow in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.

— NVD

Affected Software

2 affected componentsFixes available

pip/paddlepaddle<2.4.0

2.4.0

PaddlePaddle paddlepaddle=2.4.0-rc0

Remediation

Patch Available

https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-002.md

Event History

Dec 7, 2022

CVE Published

via MITRE·08:16 AM

Data Sourced

via MITRE·08:16 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Advisory Published

via GitHub·09:30 AM

Frequently Asked Questions

What is CVE-2022-46742?