Network Exposure Vulnerability in Apache MXNet Clustered Setup

CVE-2018-1281

Summary

The clustered setup of Apache MXNet permits the specification of an IP address and port for the scheduler through environment variables DMLC_PS_ROOT_URI and DMLC_PS_ROOT_PORT. In versions prior to 1.0.0, the framework defaults to listening on 0.0.0.0, regardless of the user-defined settings. This misconfiguration can inadvertently expose the MXNet instance to threats from unexpected external interfaces, potentially leading to unauthorized access and exploitation. To secure deployments, users should upgrade to at least version 1.0.0 and ensure that configuration settings are properly applied to limit network exposure.

References