AI agent vulnerability · TorchServe

CVE-2024-6577: TorchServe script references S3 bucket without ensuring ownership or confirming accessibility

mediumCVSS 3.0 6.3GHSA-xx7c-j7h3-vjcq

In the latest version of pytorch/serve, the script 'uploadresultstos3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity.

Published Mar 20, 2025 · Updated Mar 21, 2025

Affected packages

torchserve

Ecosystem: PyPI
Affected: <= 0.11.0
Fixed in: No patched version yet
Check: pip show torchserve

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The issue may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More TorchServe vulnerabilities

All TorchServe entries