GitHub Advisoryadvisory · PyPI

GHSA-vc3v-ppc7-v486 vantage6-server node accepts non-whitelisted algorithms from malicious server

HIGH Published 2023-11-14 Modified 2024-11-22 Official page ↗
Aliases
CVE-2023-47631
Ecosystem
PyPI
Packages
vantage6-server, vantage6-node
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-345, CWE-358
Reviewed
2023-11-14

Affected packages

• PyPI vantage6-server: < 4.1.2 → fixed in 4.1.2 • PyPI vantage6-node: < 4.1.2 → fixed in 4.1.2

Description

Impact A node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. Relevant node code here This impacts all servers that are breached by an expert user Patches Fixed in v4.1.2 Workarounds None

Related

Alias · CVE (1)

  • CVE-2023-47631 vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). vulnerability

Weakness · CWE (2)

  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-358 Improperly Implemented Security Check for Standard weakness

References