CVE-2022-25647

Advisory

Torchserve 0.6.1 updates its MAVEN dependency 'gson' to v2.9.0 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This is the release of TorchServe v0.6.1.

New Features
+ Metrics Caching in Python backend - https://github.com/pytorch/serve/pull/1954 maaquib joshuaan7
+ ONNX models served via ORT runtime & docs for TensorRT https://github.com/pytorch/serve/pull/1857. msaroufim
+ lPEX launcher core pinning https://github.com/pytorch/serve/pull/1401 . min-jean-cho - to learn more https://pytorch.org/tutorials/intermediate/torchserve_with_ipex.html

New Examples
+ DLRM example via torchrec https://github.com/pytorch/serve/issues/1648 mreso
+ Scriptable tokenizer example for text classification https://github.com/pytorch/serve/pull/1691 mreso
+ Loading large Huggingface models by using accelerate https://github.com/pytorch/serve/pull/1933 jagadeeshi2i
+ Stable diffusion Deepspeed MII example https://github.com/pytorch/serve/pull/1920 jagadeeshi2i
+ HuggingFace diffuser example https://github.com/pytorch/serve/pull/1904 jagadeeshi2i
+ On-premise near real-time video inference https://github.com/pytorch/serve/pull/1867 agunapal
+ fsspec for large scale batch inference from cloud buckets https://github.com/pytorch/serve/pull/1927 kirkpa
+ Torchdata example for unified training and inference preprocessing pipelines https://github.com/pytorch/serve/pull/1940 PratsBhatt
+ Wav2Vec2 SpeechToText from Huggingface https://github.com/pytorch/serve/pull/1939 altre

Dependency Upgrades
+ Support PyTorch 1.12 and Cuda 11.6 https://github.com/pytorch/serve/pull/1767 lxning
+ Upgraded to JDK17 - https://github.com/pytorch/serve/issues/1619 rohithkrn
+ Bumped gson version for security https://github.com/pytorch/serve/pull/1650 lxning


Improvements
+ Optimized gRPC workflow performance https://github.com/pytorch/serve/pull/1854 for gRPC workflow. lxning
+ Fixed worker shown as ready in DescribeModel endpoint before model is loaded https://github.com/pytorch/serve/issues/1679. lxning
+ Gracefully handle decoding exceptions in python backend https://github.com/pytorch/serve/pull/1789 msaroufim
+ Added handle OPTIONS in management API https://github.com/pytorch/serve/pull/1774 xyang16
+ Fixed model status API in KServe https://github.com/pytorch/serve/pull/1773 jagadeeshi2i
+ Fixed process verification in pid file - https://github.com/pytorch/serve/pull/1866 rohithkrn
+ Updated Nvidia Waveglow/Tacotron2 https://github.com/pytorch/serve/pull/1905 kbumsik
+ Added dev mode in `install_from_src.py` https://github.com/pytorch/serve/pull/1856 msaroufim
+ Added the PV creation for K8 setup https://github.com/pytorch/serve/pull/1751 jagadeeshi2i
+ Fixed volume permission in kubernetes setup https://github.com/pytorch/serve/pull/1747 jagadeeshi2i
+ Upgraded hpa with v2beta2 api version https://github.com/pytorch/serve/pull/1760 jagadeeshi2i
+ Fixed gradle deprecation method https://github.com/pytorch/serve/pull/1936 lxning
+ Updated plugins/gradle.properties https://github.com/pytorch/serve/pull/1791 liyaodev
+ Fixed pynvml import failure https://github.com/pytorch/serve/pull/1882 lxning
+ Added pynvml exception management https://github.com/pytorch/serve/pull/1809 lromor
+ Fixed an erroneous logging format string and pylint pragma https://github.com/pytorch/serve/pull/1630 bradlarsen
+ Fixed broken path joins and unclosed files https://github.com/pytorch/serve/pull/1709 DPeled

Build and CI
+ Added ubuntu 20.04 GPU in docker build - https://github.com/pytorch/serve/pull/1773 msaroufim
+ Added spellchecking and link checking automation https://github.com/pytorch/serve/pull/1855 sadra-barikbin
+ Added full release automation https://github.com/pytorch/serve/pull/1739 msaroufim
+ Added workflow for pushing Conda nightly binaries https://github.com/pytorch/serve/pull/1685 agunapal
+ Added code coverage https://github.com/pytorch/serve/pull/1665 in CI build msaroufim
+ Unified documentation build dependencies https://github.com/pytorch/serve/pull/1759 msaroufim
+ Added skipping spellcheck if no changed files https://github.com/pytorch/serve/pull/1919 for skipping spellcheck if no changed files. maaquib
+ Added skipping flaky Java Windows test cases https://github.com/pytorch/serve/pull/1746 msaroufim
+ Added alarm on failed github action https://github.com/pytorch/serve/pull/1781 msaroufim

Documentation
+ Updated FAQ https://github.com/pytorch/serve/pull/1393 for how to decode international language lxning
+ Improved KServe documentation https://github.com/pytorch/serve/pull/1807 jagadeeshi2i
+ Updated `[examples/intel_extension_for_pytorch/README.md` https://github.com/pytorch/serve/pull/1816 min-jean-cho
+ Fixed typos and dead links in doc.

Deprecations
+ Deprecated old `ci/benchmark/buildspec.yml` https://github.com/pytorch/serve/pull/1658 lxning
+ Deprecated old `docker/Dockerfile.neuron.dev` https://github.com/pytorch/serve/pull/1775 in favor of AWS SageMaker DLC. rohithkrn
+ Deprecated redundant `LICENSE.txt` https://github.com/pytorch/serve/pull/1801 msaroufim

Platform Support
Ubuntu 16.04, Ubuntu 18.04, MacOS 10.14+, Windows 10 Pro, Windows Server 2019, Windows subsystem for Linux (Windows Server 2019, WSLv1, Ubuntu 18.0.4). TorchServe now requires Python 3.8 and above, and JDK17.

GPU Support

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25647