CVE-2023-38673: Command injection in fs.py
PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-38673?
CVE-2023-38673 is a command injection vulnerability found in PaddlePaddle before version 2.5.0, which allows an attacker to execute arbitrary commands on the operating system.
How severe is CVE-2023-38673?
CVE-2023-38673 has a severity score of 9.8 (Critical).
What software versions are affected by CVE-2023-38673?
PaddlePaddle versions up to exclusive 2.5.0 and pip package paddlepaddle versions between inclusive 0 and exclusive 2.5.0 are affected by CVE-2023-38673.
How can I fix CVE-2023-38673?
To fix CVE-2023-38673, update PaddlePaddle to version 2.5.0 or later and update the paddlepaddle pip package to a version higher than 2.5.0.
Where can I find more information about CVE-2023-38673?
You can find more information about CVE-2023-38673 in the PaddlePaddle security advisory, NIST National Vulnerability Database, and the PaddlePaddle GitHub commit.