PyPI/vantage6-node CVE-2023-28635: medium 5.4, EPSS 0.50%
vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with int
Action: Upgrade vantage6-node to 4.0.0 or later.
pip install vantage6-node==4.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.0 | - |
Fixed versions
| 4.0.0 |
Sources
- osv: PYSEC-2023-198
- https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400
- https://github.com/vantage6/vantage6/security/advisories/GHSA-7x94-6g2m-3hp2
- https://github.com/vantage6/vantage6/pull/744
CVE-2023-28635 · published · modified · JSON