AWS dlami: Narrow unpatched-CVE notice to PyTorch 2.10-2.12 DLAMIs
Summary
Updates the security notice so it covers PyTorch 2.10 through 2.12 instead of 2.9 through 2.12, and removes the PyTorch 2.9 GPU (Amazon Linux 2023 and Ubuntu 24.04) release-note links from the x86 and ARM64 sections.
Security assessment
The changed line explicitly documents that certain DLAMI images ship with known, unpatched CVEs and that no security backports are provided; the edit removes PyTorch 2.9 from that unpatched set, i.e. it corrects the scope of a security advisory about vulnerable images. No specific CVE identifier is given in the diff.
Evidence
+PyTorch DLAMIs for versions 2.10 through 2.12 (PyTorch 2.10, 2.11, and 2.12) contain known common vulnerabilities and exposures (CVEs) that cannot be patched. Because we maintain a separate DLAMI currency release for each PyTorch version, we do not backport security fixes to these images.
Diff
diff --git a/dlami/latest/devguide/appendix-ami-release-notes.md b/dlami/latest/devguide/appendix-ami-release-notes.md index 13690a3..c7888b0 100644 --- a//dlami/latest/devguide/appendix-ami-release-notes.md +++ b//dlami/latest/devguide/appendix-ami-release-notes.md @@ -15 +15 @@ For release notes for DLAMI frameworks that we no longer support, see the **Unsu -###### Security patches not available for PyTorch 2.9 through 2.12 DLAMIs +###### Security patches not available for PyTorch 2.10 through 2.12 DLAMIs @@ -17 +17 @@ For release notes for DLAMI frameworks that we no longer support, see the **Unsu -PyTorch DLAMIs for versions 2.9 through 2.12 (that is, PyTorch 2.9, 2.10, 2.11, and 2.12) contain known common vulnerabilities and exposures (CVEs) that cannot be patched. Because we maintain a separate DLAMI currency release for each PyTorch version, we do not backport security fixes to these images. +PyTorch DLAMIs for versions 2.10 through 2.12 (PyTorch 2.10, 2.11, and 2.12) contain known common vulnerabilities and exposures (CVEs) that cannot be patched. Because we maintain a separate DLAMI currency release for each PyTorch version, we do not backport security fixes to these images. @@ -125,4 +124,0 @@ Below are the Release notes for X86 PyTorch DLAMIs: - * [GPU PyTorch 2.9 (Amazon Linux 2023)](./aws-deep-learning-x86-gpu-pytorch-2.9-amazon-linux-2023.html) - - * [GPU PyTorch 2.9 (Ubuntu 24.04)](./aws-deep-learning-x86-gpu-pytorch-2.9-ubuntu-24-04.html) - @@ -160,4 +155,0 @@ Below are the Release notes for ARM64 PyTorch DLAMIs: - * [ARM64 AMI GPU PyTorch 2.9 (Amazon Linux 2023)](./aws-deep-learning-arm64-gpu-pytorch-2.9-amazon-linux-2023.html) - - * [ARM64 AMI GPU PyTorch 2.9 (Ubuntu 24.04)](./aws-deep-learning-arm64-gpu-pytorch-2.9-ubuntu-24-04.html) -