Home » Database

AVID-2026-R0883

Description

Dependency injection in NVCaffe (CVE-2021-39158)

Details

NVCaffe’s python required dependencies list used to contain gfortranversion prior to 0.17.4, entry which does not exist in the repository pypi.org. An attacker could potentially have posted malicious files to pypi.org causing a user to install it within NVCaffe.

Reason for inclusion in AVID: The candidate describes CVE-2021-39158 affecting NVCaffe with a dependency mis-verification that could allow a malicious PyPI package to be installed, enabling a supply-chain-level attack. This directly concerns AI software stacks (NVCaffe) and their dependencies, representing a security vulnerability in software supply chains used to build/run general-purpose AI systems.

References

Affected or Relevant Artifacts

  • Developer: NVIDIA
  • Deployer: NVIDIA
  • Artifact Details:
TypeName
Systemcaffe

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-345CWE-345: Insufficient Verification of Data Authenticity

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2021-08-23
  • Version: 0.3.3
  • AVID Entry