Hydra Python Package: Potential Arbitrary Code Execution Risk
- Severity
- HIGH
- Affected component
- hydra (pypi)
- Patched version
- 1.3.4
An early warning has been issued for a vulnerability in the Hydra Python package. The hydra.utils.instantiate() function can reportedly lead to arbitrary code execution if untrusted configuration is passed to it.
What happened
The vulnerability in question affects the hydra.utils.instantiate() function of the Hydra Python package. If untrusted configuration is passed to this function, it can lead to arbitrary code execution. This means that an attacker could potentially execute code in the process that calls hydra.utils.instantiate(). The issue is under investigation and has been flagged with a high severity level.
To assess your exposure, check if your software uses the Hydra Python package and if the hydra.utils.instantiate() function is utilized with untrusted configurations. The reported affected versions are those prior to 1.3.4. It is recommended to upgrade to version 1.3.4 or later to mitigate the risk.
What to do about it
- Check your software dependencies for the Hydra Python package.
- If your software uses Hydra, verify the version and upgrade to version 1.3.4 or later.
- Review your code to ensure that hydra.utils.instantiate() is not used with untrusted configurations.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation advice.
- Consider implementing additional security measures to protect against arbitrary code execution vulnerabilities.
How 0Day would have caught this
hydra is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if your software uses the Hydra Python package in versions prior to 1.3.4 and utilizes the hydra.utils.instantiate() function with untrusted configurations.
What should I do right now?
Immediately check your software for the Hydra Python package and upgrade to version 1.3.4 or later if you are using an affected version.
Is there an official fix available?
Yes, the recommended fix is to upgrade to Hydra version 1.3.4 or later.
Where can I find more information?
Consult the primary sources provided for the most up-to-date information on the vulnerability.