Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                              CERT-Renater

                  Note d'Information No. 2025/VULN058

_____________________________________________________________________

DATE                : 30/01/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Deep Java Library versions prior
                                         to 0.31.1.

=====================================================================
https://github.com/advisories/GHSA-jcrp-x7w3-ffmg
_____________________________________________________________________

Deep Java Library path traversal issue

Critical severity GitHub Reviewed Published Jan 29, 2025 in
deepjavalibrary/djl • Updated Jan 30, 2025

Vulnerability details

Package
ai.djl:api (Maven)

Affected versions
< 0.31.1

Patched versions
0.31.1


Description

Summary

Deep Java Library (DJL) is an open-source, high-level, engine-agnostic
Java framework for deep learning. DJL is designed to be easy to get
started with and simple to use for Java developers. DJL provides a
native Java development experience and functions like any other regular
Java library.

DJL provides utilities for extracting tar and zip model archives that
are used when loading models for use with DJL. These utilities were
found to contain issues that do not protect against absolute path
traversal during the extraction process.


Impact

An issue exists with DJL's untar and unzip functionalities.
Specifically, it is possible to create an archive on a Windows system,
and when extracted on a MacOS or Linux system, write artifacts
outside the intended destination during the extraction process. The
reverse is also true for archives created on MacOS/Linux systems and
extracted on Windows systems.

Impacted versions: 0.1.0 - 0.31.0


Patches

This issue has been patched in DJL 0.31.1 [1]


Workarounds

Do not use model archive files from sources you do not trust. You
should only use model archives from official sources like the DJL
Model Zoo, or models that you have created and packaged yourself.


References

If you have any questions or comments about this advisory, we ask
that you contact AWS/Amazon Security via our vulnerability
reporting page [2] or directly via email to
aws-security@amazon.com. Please do not create a public GitHub
issue.

[1] https://github.com/deepjavalibrary/djl/tree/v0.31.1
[2] https://aws.amazon.com/security/vulnerability-reporting


References

    GHSA-jcrp-x7w3-ffmg
    deepjavalibrary/djl@7415cc5
    https://nvd.nist.gov/vuln/detail/CVE-2025-0851
    https://aws.amazon.com/security/security-bulletins/AWS-2025-003

@siddvenk siddvenk published to deepjavalibrary/djl Jan 29, 2025
Published by the National Vulnerability Database Jan 29, 2025
Published to the GitHub Advisory Database Jan 29, 2025
Reviewed Jan 29, 2025
Last updated Jan 30, 2025


Severity
Critical

9.3 / 10

CVSS v4 base metrics

Exploitability Metrics
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required None
User interaction None
Vulnerable System Impact Metrics
Confidentiality High
Integrity High
Availability High
Subsequent System Impact Metrics
Confidentiality None
Integrity None
Availability None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E/CR/IR/AR/MAV/MAC/MAT/MPR/MUI/MVC/MVI/MVA/MSC/MSI/MSA/S/AU/R/V/RE/U

EPSS score

Weaknesses
CWE-22 CWE-36

CVE ID
CVE-2025-0851

GHSA ID
GHSA-jcrp-x7w3-ffmg

Source code
deepjavalibrary/djl

This advisory has been edited. See History.
See something to contribute? Suggest improvements for this
vulnerability.

        
=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================