ghsa-vc3v-ppc7-v486
Vulnerability from github
Published
2023-11-14 22:21
Modified
2023-11-14 22:21
Severity
Summary
vantage6-server node accepts non-whitelisted algorithms from malicious server
Details
Impact
A node does not check if an image is allowed to run if a parent_id is set. A malicious party that breaches the server may modify it to set a fake parent_id and send a task of a non-whitelisted algorithm. The node will then execute it because the parent_id that is set prevents checks from being run. Relevant node code here
This impacts all servers that are breached by an expert user
Patches
Fixed in v4.1.2
Workarounds
None
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vantage6-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-47631"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-358"
],
"github_reviewed": true,
"github_reviewed_at": "2023-11-14T22:21:57Z",
"nvd_published_at": "2023-11-14T21:15:13Z",
"severity": "HIGH"
},
"details": "### Impact\nA node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. Relevant node code [here](https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268)\n\nThis impacts all servers that are breached by an expert user\n\n### Patches\nFixed in v4.1.2\n\n### Workarounds\nNone\n\n",
"id": "GHSA-vc3v-ppc7-v486",
"modified": "2023-11-14T22:21:57Z",
"published": "2023-11-14T22:21:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-vc3v-ppc7-v486"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47631"
},
{
"type": "WEB",
"url": "https://github.com/vantage6/vantage6/commit/bf83521eb12fa80aa5fc92ef1692010a9a7f8243"
},
{
"type": "PACKAGE",
"url": "https://github.com/vantage6/vantage6"
},
{
"type": "WEB",
"url": "https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "vantage6-server node accepts non-whitelisted algorithms from malicious server"
}
Loading...