CVE-2023-47631: vantage6-server node accepts non-whitelisted algorithms from malicious server
Summary
CVE-2023-47631: vantage6-server node accepts non-whitelisted algorithms from malicious server. Affects vantage6-server versions < 4.1.2. Fixed in 4.1.2. How to fix ↓
Also tracked for
- vantage6-node · PyPI
The same CVE-2023-47631 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vantage6-server package is an open-source Python package available on PyPI. It is a component of the vantage6 platform, which provides a collaborative infrastructure for distributed machine learning and data analysis. The vantage6-server package is responsible for managing nodes and coordinating tasks in the vantage6 network. It allows users to submit tasks to be executed by nodes and provides a secure environment for running algorithms on sensitive data.
Vulnerability Detail
The vantage6-server node does not properly check if an image is allowed to run when a parent_id is set. This vulnerability can be exploited by a malicious party who breaches the server and modifies it to set a fake parent_id. They can then send a task with a non-whitelisted algorithm, which the node will execute because the presence of the parent_id prevents the necessary checks from being performed. This vulnerability affects all servers that are breached by an expert user. The impact of this vulnerability is significant as it allows unauthorized execution of non-whitelisted algorithms, potentially leading to unauthorized access, data leakage, or other malicious activities.
How To Fix
Minimum fixed version
4.1.2
This is the first release that contains the fix.
pip install --upgrade "vantage6-server==4.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of the vantage6-server package as soon as possible.
Conclusion
The vantage6-server package is vulnerable to a critical security issue that allows unauthorized execution of non-whitelisted algorithms. This vulnerability has been fixed in version 4.1.2 of the package. Users are advised to update their vantage6-server package to the latest version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vantage6-server →
FAQ
The vantage6-server package is a Python package that is part of the vantage6 platform. It provides the server-side functionality for managing nodes and coordinating tasks in the vantage6 network.
This vulnerability allows a malicious party to execute non-whitelisted algorithms on a breached vantage6-server node. This can lead to unauthorized access, data leakage, or other malicious activities.
To fix this vulnerability, update your vantage6-server package to version 4.1.2 or later.
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of the vantage6-server package.
More information about the vantage6 platform can be found on the official website at https://vantage6.ai.
References
Related vulnerabilities
Recent vulnerabilities recorded for vantage6-server.
