CVE-2024-27319: 
Python vulnerability analysis and mitigation

CVE-2024-27319 affects versions of the ONNX package before and including 1.15.0. The vulnerability was discovered in February 2024 and involves an Out-of-bounds Read vulnerability in the ONNX_ASSERT and ONNX_ASSERTM functions due to an off-by-one string copy issue (NVD).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and has received varying CVSS scores. The National Vulnerability Database (NVD) assigned a CVSS v3.1 base score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, while HiddenLayer assigned a more moderate score of 4.4 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L (NVD).

The Out-of-bounds Read vulnerability could potentially lead to information disclosure and system availability issues. The high CVSS score from NVD indicates potential for significant impact, particularly in terms of confidentiality and availability (NVD).

A fix has been implemented and is available in versions after 1.15.0. Fedora has released security updates for both Fedora 39 (onnx-1.14.0-9.fc39) and Fedora 40 (onnx-1.14.1-2.fc40) to address this vulnerability (Fedora 39 Update, Fedora 40 Update).