PT-2023-19304 · Vantage6 · Vantage6

Frankcorneliusmartin · Publicado 2023-10-11 · Atualizado 2023-10-13 · CVE-2023-23930

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 4.0.0

Description vantage6 is a privacy-preserving federated learning infrastructure. The issue arises from the use of pickle as the default serialization module, which has known security issues. All users of vantage6 that post tasks with the default serialization are affected. As a workaround, users may specify JSON serialization.

Recommendations For versions prior to 4.0.0, update to version 4.0.0, which contains a patch. As a temporary workaround, consider specifying JSON serialization instead of the default pickle serialization.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2023-23930

GHSA-5M22-CFQ9-86X6

PYSEC-2023-196

Produtos afetados

Vantage6

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23930.json · Exploit
• 🔥 https://medium.com/ochrona/python-pickle-is-notoriously-insecure-d6651f1974c9 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-196.yaml · Nota
• https://github.com/vantage6/vantage6 · Nota
• https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400 · Nota
• https://github.com/vantage6/vantage6/commit/e62f03bacf2247bd59eed217e2e7338c3a01a5f0 · Correção
• https://github.com/vantage6/vantage6/security/advisories/GHSA-5m22-cfq9-86x6 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-196 · Aviso do Fabricante
• https://t.me/cibsecurity/72139 · Publicação no Telegram
• https://t.me/cvenotify/59299 · Publicação no Telegram
• https://t.me/cvenotify/59305 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1712207992920142064 · Publicação no Twitter
• https://t.me/cvenotify/59464 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-23930 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-23930 · Aviso do Fabricante