PT-2022-8712 · Webank · Webank Fate

Published 2021-01-22 · Updated 2022-06-28 · CVE-2020-25459

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WeBank FATE (Federated AI Technology Enabler) versions 0.1 through 1.4.2

Description An issue in the sync tree function in hetero decision tree guest.py allows attackers to read sensitive information during the training process of machine learning joint modeling.

Recommendations For WeBank FATE (Federated AI Technology Enabler) versions 0.1 through 1.4.2, consider disabling the sync tree function in hetero decision tree guest.py as a temporary workaround until a patch is available.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2020-25459

MGASA-2021-0049

Affected Products

Webank Fate

References · 9

• https://github.com/FederatedAI/FATE/commit/6feccf6d752184a6f9365d56a76fe627983e7139 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-25459 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0049 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25459 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0049.html · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=27444 · Note
• https://t.me/cibsecurity/44693 · Telegram Post
• https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00032.html · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/RKSUG2OZN3Y2FQVQ55HP5MZIQZXZ5OD6 · Note