{"action":"Upgrade mindsdb to 23.7.4.0 or later.","affected":[{"fixed":"23.7.4.0","introduced":"0"}],"component":"mindsdb","cve_ids":["CVE-2023-38699"],"ecosystem":"PyPI","epss":0.00296,"exploited":false,"fixed_versions":["23.7.4.0"],"ghsa_id":"GHSA-8hx6-qv6f-xgcw","id":"tcs_01M5KGJGA8KAPZTA5H1902HX26","modified_at":"2023-11-08T04:13:09.667600Z","published_at":"2023-08-04T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-140","https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw","https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b","https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2023-140","url":"https://osv.dev/vulnerability/PYSEC-2023-140"}],"summary":"MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This ru"}