Evidence · DiggingBeagle record
MONAI missing expected download hash accepted advisory
Maintainer disclosure of a model or dataset download verifier returning success when no known hash is supplied.
- Source role
- primary disclosure
Evidence record
Maintainer disclosure of a model or dataset download verifier returning success when no known hash is supplied.
Claim-level citations (2)
- supportsMONAI model download verification reported success with no expected hash: The MONAI security advisory reports check_hash accepting a missing expected hash value as success, allowing download paths without an externally pinned digest to appear verified.
GHSA-hhh4-h52m-fqh6: check_hash(hash_val=None), downloader call sites, remediation caveats
- supportsMONAI model download verification reported success with no expected hash: MONAI check_hash returned a successful result when the expected digest argument was None, despite documentation presenting the operation as an integrity check. The weak state arises when a model or dataset retrieval call lacks a pinned hash and an adversary can modify the downloaded bytes. A substituted model artifact could pass a nominal hash-checking step without actually being authenticated against known content.
GHSA-hhh4-h52m-fqh6: check_hash(hash_val=None), downloader call sites, remediation caveats