Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ultralytics 8.3.x (multiple) #219

Merged
merged 2 commits into from
Dec 10, 2024
+48 −0
Merged

ultralytics 8.3.x (multiple) #219

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
35a3791
ultralytics 8.3.x (multiple)
miketheman Dec 10, 2024
91dd9dc
remove comment
miketheman Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions vulns/ultralytics/PYSEC-0000-ultralytics.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
# TODO: Fill in the details below, and remove any comments prior to committing.
# See https://ossf.github.io/osv-schema/ for format and field descriptions.
miketheman marked this conversation as resolved.
Show resolved Hide resolved
id: PYSEC-0000-ultralytics.yaml
modified: 2024-12-10T16:51:23Z
summary: A number of releases of ultralytics contained malicious crypto miner software.
details: |
Ultralytics has identified a supply chain attack
affecting affecting multiple versions of the ultralytics package.
The compromised versions contained unauthorized code that
downloaded and executed cryptocurrency mining software
when instantiating YOLO models.
This code was injected into the PyPI release artifacts and was not present
in the public GitHub repository.
affected:
- package:
ecosystem: PyPI
name: ultralytics
purl: pkg:pypi/ultralytics
versions:
- "8.3.41"
- "8.3.42"
- "8.3.45"
- "8.3.46"
ranges:
- type: ECOSYSTEM
events:
- introduced: "8.3.41"
sethmlarson marked this conversation as resolved.
Show resolved Hide resolved
- fixed: "8.3.47"
severity:
- type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- type: CVSS_V4
score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
related:
- GHSA-7x29-qqmq-v6qc
references:
- type: EVIDENCE
url: https://inspector.pypi.io/project/ultralytics/8.3.41/packages/d0/99/13d92174aa6a470d348a95e31164769f2cdf77838ea3c3e3fd476285777d/ultralytics-8.3.41-py3-none-any.whl/ultralytics/utils/downloads.py#line.284
- type: WEB
url: https://github.com/ultralytics/ultralytics/pull/18020#issuecomment-2525180194
- type: REPORT
url: https://github.com/ultralytics/ultralytics/issues/18027
- type: FIX
url: https://github.com/ultralytics/ultralytics/pull/18052
- type: FIX
url: https://github.com/ultralytics/ultralytics/pull/18111
- type: FIX
url: https://github.com/ultralytics/ultralytics/releases/tag/v8.3.48
- type: ARTICLE
url: https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection
Loading