vantage6-server node accepts non-whitelisted algorithms from malicious server

高 8.8CVE-2023-47631 · GHSA-vc3v-ppc7-v486 · PYSEC-2023-303 · 14/11/2023 公開 · 17/06/2026 更新

要点

CVE-2023-47631 は vantage6-node, vantage6-server, vantage6 (vantage6) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.45%（全脆弱性の 38.8% より高い）。
対処：4.1.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
vantage6-node PyPI	`< 4.1.2`	`4.1.2`
vantage6-server PyPI	`< 4.1.2`	`4.1.2`
vantage6 vantage6	`= 4.1.2< 4.1.2`	`4.1.2`

概要

Impact

A node does not check if an image is allowed to run if a parent_id is set. A malicious party that breaches the server may modify it to set a fake parent_id and send a task of a non-whitelisted algorithm. The node will then execute it because the parent_id that is set prevents checks from being run. Relevant node code here

This impacts all servers that are breached by an expert user

Patches

Fixed in v4.1.2

Workarounds

None

NVD の説明

vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.