Approved changes feed: RSS · Atom
cpe:2.3:a:deepjavalibrary:djl:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Deepjavalibrary (97772054-0d95-5d2c-827a-76835c07b186) |
|---|---|
| Product | Djl (70e44104-da06-5485-8b8e-e2dbe7d951bd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-37902 |
vulnerable | 2026-06-08 06:39:48.228407 |
Path thraversal in DeepJavaLibrary
CRITICAL (10)
DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.
Published: 2024-06-17T19:25:21.831Z
Updated: 2024-08-02T04:04:23.429Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2914 |
vulnerable | 2026-06-08 06:35:27.692235 |
TarSlip Vulnerability in deepjavalibrary/djl
HIGH (7.8)
A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manipulate file paths within tar archives to overwrite arbitrary files on the target system. Exploitation of this vulnerability could lead to remote code execution, privilege escalation, data theft or manipulation, and denial of service. The vulnerability is due to improper validation of file paths during the extraction of tar files, as demonstrated in multiple occurrences within the library's codebase, including but not limited to the files_util.py and extract_imagenet.py scripts.
Published: 2024-06-06T17:55:55.145Z
Updated: 2024-08-01T19:25:42.176Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.