PT-2023-26563 · Mindsdb+1 · Mindsdb+1

Truesoni · Published 2023-08-01 · Updated 2023-08-10 · CVE-2023-38699

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MindsDB versions prior to 23.7.4.0

Description The issue concerns the MindsDB's AI Virtual Database, which allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with verify=False disables SSL certificate checks. This behavior can compromise the security of applications by not guaranteeing the identity of the party being communicated with. Using TLS can significantly increase security by presenting trusted certificates during the connection initialization phase.

Recommendations For versions prior to 23.7.4.0, update to version 23.7.4.0 or later, where certificates are validated by default. As a temporary workaround, consider setting verify=True for all requests to ensure SSL certificate checks are enabled. Restrict access to the Requests library until the update is applied to minimize the risk of exploitation.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2023-38699

GHSA-8HX6-QV6F-XGCW

PYSEC-2023-140

Affected Products

Mindsdb

Requests

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38699.json · Exploit
• https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b · Patch
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38699 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38699 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8hx6-qv6f-xgcw · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-140 · Vendor Advisory
• https://github.com/mindsdb/mindsdb · Note
• https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-140.yaml · Note
• https://t.me/cvenotify/56199 · Telegram Post