Nixpkgs security tracker
5.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version() can dereference a null pointer in Upsample_6_7::adapt_upsample_6_7() in onnx/version_converter/adapters/upsample_6_7.h when processing an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. This issue is fixed in version 1.22.0.
References
-
https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77 x_refsource_CONFIRM
-
https://github.com/onnx/onnx/pull/7813 x_refsource_MISC
-
https://github.com/onnx/onnx/releases/tag/v1.22.0 x_refsource_MISC
Affected products
- ==>= 1.9.0, < 1.22.0
Matching in nixpkgs
pkgs.onnx
Open Neural Network Exchange
pkgs.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.sherpa-onnx
Speech-to-text, text-to-speech, and speaker recognition using next-gen Kaldi with onnxruntime
pkgs.pkgsRocm.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.pkgsRocm.sherpa-onnx
Speech-to-text, text-to-speech, and speaker recognition using next-gen Kaldi with onnxruntime
pkgs.python313Packages.onnx
Open Neural Network Exchange
pkgs.python314Packages.onnx
Open Neural Network Exchange
pkgs.python313Packages.onnx-ir
Efficient in-memory representation for ONNX, in Python
pkgs.python313Packages.tf2onnx
Convert TensorFlow, Keras, Tensorflow.js and Tflite models to ONNX
pkgs.python314Packages.onnx-ir
Efficient in-memory representation for ONNX, in Python
pkgs.python313Packages.onnx-asr
Lightweight Automatic Speech Recognition using ONNX models
pkgs.python313Packages.onnxslim
Toolkit to Help Optimize Onnx Model
pkgs.python313Packages.skl2onnx
Convert scikit-learn models to ONNX
pkgs.python314Packages.onnx-asr
Lightweight Automatic Speech Recognition using ONNX models
pkgs.python314Packages.onnxslim
Toolkit to Help Optimize Onnx Model
pkgs.python314Packages.skl2onnx
Convert scikit-learn models to ONNX
pkgs.python313Packages.onnxscript
Naturally author ONNX functions and models using a subset of Python
pkgs.python314Packages.onnxscript
Naturally author ONNX functions and models using a subset of Python
pkgs.python313Packages.onnxmltools
ONNXMLTools enables conversion of models to ONNX
pkgs.python313Packages.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.python313Packages.sherpa-onnx
Python bindings for sherpa-onnx speech recognition
pkgs.python314Packages.onnxmltools
ONNXMLTools enables conversion of models to ONNX
pkgs.python314Packages.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.python314Packages.sherpa-onnx
Python bindings for sherpa-onnx speech recognition
pkgs.python313Packages.optimum-onnx
Export your model to ONNX and run inference with ONNX Runtime
pkgs.python314Packages.optimum-onnx
Export your model to ONNX and run inference with ONNX Runtime
pkgs.pkgsRocm.python3Packages.onnx-ir
Efficient in-memory representation for ONNX, in Python
pkgs.pkgsRocm.python3Packages.tf2onnx
Convert TensorFlow, Keras, Tensorflow.js and Tflite models to ONNX
pkgs.pkgsRocm.python3Packages.onnx-asr
Lightweight Automatic Speech Recognition using ONNX models
pkgs.pkgsRocm.python3Packages.onnxscript
Naturally author ONNX functions and models using a subset of Python
pkgs.python313Packages.onnxruntime-tools
Transformers Model Optimization Tool of ONNXRuntime
pkgs.python314Packages.onnxruntime-tools
Transformers Model Optimization Tool of ONNXRuntime
pkgs.pkgsRocm.python3Packages.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.pkgsRocm.python3Packages.sherpa-onnx
Python bindings for sherpa-onnx speech recognition
pkgs.pkgsRocm.python3Packages.optimum-onnx
Export your model to ONNX and run inference with ONNX Runtime
pkgs.python313Packages.onnxconverter-common
ONNX Converter and Optimization Tools
pkgs.python313Packages.rapidocr-onnxruntime
Cross platform OCR Library based on OnnxRuntime
pkgs.python314Packages.onnxconverter-common
ONNX Converter and Optimization Tools
pkgs.python314Packages.rapidocr-onnxruntime
Cross platform OCR Library based on OnnxRuntime
Package maintainers
-
@acairncross Aiken Cairncross <acairncross@gmail.com>
-
@ConnorBaker Connor Baker <ConnorBaker01@gmail.com>
-
@puffnfresh Brian McKenna <brian@brianmckenna.org>
-
@ck3d Christian Kögler <ck3d@gmx.de>
-
@jaredmontoya Jared Montoya
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>
-
@wrvsrx wrvsrx <wrvsrx@outlook.com>
-
@happysalada Raphael Megzari <raphael@megzari.com>