Sagemaker DLC and Log4j
Hi all,I asked a question in the Discord a few days ago and was told to move it here instead.In the wake of the Log4j vulnerability, should we expect any updated versions of theHuggingFace Deep Learning Containerimages usedfor the SageMaker integration, or have y’all confirmed that none of your versions are vulnerable in this way?All the best,Charles
2021-12-17T15:39:24Z
Hey@charlesatftl,I was in contact with AWS and the SageMaker Team and got the following response fromYogesh Sharma Engineering Manager for the DLCsHello,We ran a canary scan to exercise caution and find out if HF DLCs are impacted by the log4j vulnerability. I can confirm that both Hugging Face TensorFlow and Hugging Face PyTorch DLCs arenotimpacted by the log4j issue.Some of DLC’s upstream libraries use log4j v1.2 which is old but is not impacted by this CVE (it impacts v2.x). Teams at AWS have decided that we will upgrade the log4j version early January to v2.16 just to be on the latest safe version.Let us know if you have further questions, thanks.