Debian alert DLA-4389-1 (pytorch)

From:
             
 
Daniel Leidert <dleidert@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4389-1] pytorch security update
Date:
             
 
Mon, 01 Dec 2025 02:15:40 +0100
Message-ID:
             
 
<ffa24403559e4bf9e671e7e964ac4fcf2b0d42d5.camel@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4389-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Daniel Leidert
December 01, 2025                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : pytorch
Version        : 1.7.1-7+deb11u1
CVE ID         : CVE-2025-32434


A possible remote code execution (RCE) vulnerability has been
discovered in pytorch, an open source machine learning framework.


CVE-2025-32434

   Possible RCE when loading a model using torch.load with
   weights_only=True.


For Debian 11 bullseye, this problem has been fixed in version
1.7.1-7+deb11u1.

We recommend that you upgrade your pytorch packages.

For the detailed security status of pytorch please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/pytorch

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJIBAABCgAyFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmks7DwUHGRsZWlkZXJ0
QGRlYmlhbi5vcmcACgkQS80FZ8KW0F2uCBAAouZOea+lwGNSBBDPQT48jIsFnla5
WsqsCThc1Dl9Ncz+1LiIxpb1OxFTvC7qbbpnl655Dq71GhXc9FFUw+U8NJsWs02A
lOmCsVQULnacDwDKTo4IplbKpgm6aAj8tHuWS4o8BYvUAPXE5EEP/rUPfR/6oc+p
v7+C/CfWbR5f6nUzHjf8R3BTqIwoBh8+wCTA/5P/Z7rpaZYDyb44l1DHv8znV/3B
35xRusiywa5suNOApKj5a/yXgO3vqbQyiYi9zvqovs1ltx/ucCdkhx0kKIdYs3O/
q2GQLiuCYSflzTKytvL+/UcyV1taONE+kNhxCDmHXWlcdj34FGMoveYJ96xYlL/R
Z/onrWIKEg5j9m9hivypegCo3bdbtXFmoMIv89jJPaHqSkeebK/Btp6oELxhUDFr
zqATZZ6rxRHE+TqdVV2CIpyCpGwpvn0KciWzJnCUC+u3AzPnB2jiunooOBlytHqb
kNg3mIuedlP12av6brGLYymgAFytkCmu5NjJ1qyCrpdle74IjvD+fF3DY0g8wmpR
fhZuuFtrmvAiQD65H1mAhE84C4RQAtfm0gKdDoTCa1gYGKwLGVlrzY1WRltIQsyb
EDt3GmjE8WZ30yFr9PCsXvgJWWaLN5ZQQRnyslEvcuDz+EP0+zQZ7OOoL81oYjRV
3jvnyRrUvKsy050=
=YXVk
-----END PGP SIGNATURE-----