{"action":"Upgrade vantage6 to 4.0.0 or later.","affected":[{"fixed":"4.0.0","introduced":"0"}],"component":"vantage6","cve_ids":["CVE-2023-41882"],"ecosystem":"PyPI","epss":0.00497,"exploited":false,"fixed_versions":["4.0.0"],"ghsa_id":"GHSA-gc57-xhh5-m94r","id":"tcs_01M5KGJVEX1CQJC2ZXQ0RYS04X","modified_at":"2023-11-08T04:13:26.700629Z","published_at":"2023-10-11T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-201","https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400","https://github.com/vantage6/vantage6/pull/711","https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2023-201","url":"https://osv.dev/vulnerability/PYSEC-2023-201"}],"summary":"vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should"}