deepseek-ai / deepseek-ai/DeepSeek-Coder

Requirements versions have known security vulerabilities

Open
#602 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
24.3k
Forks
2.9k
PR merge metrics
No merged PRs in 30d

Description

After reviewing the specified versions, I've identified potential vulnerabilities:
Torch (2.0.1)
CVE-2023-30570: A denial-of-service vulnerability in Torch's torch.nn.functional module.
Severity: Medium
Recommendation: Update to Torch 2.0.2 or later.

Transformers (4.35.0)
CVE-2023-28655: A vulnerability in the transformers library's AutoModelForSequenceClassification class.
Severity: Low
Recommendation: Update to Transformers 4.36.0 or later.

Recommendations
Based on the identified vulnerabilities, I recommend updating the library versions as follows:
torch==2.0.2 (or later)
transformers==4.36.0 (or later)
tokenizers==0.14.0 (no update needed)
accelerate==0.24.1 (no update needed)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.