Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12YzN2LXBwYzctdjQ4Ns4AA3K2

vantage6-server node accepts non-whitelisted algorithms from malicious server

Impact

A node does not check if an image is allowed to run if a parent_id is set. A malicious party that breaches the server may modify it to set a fake parent_id and send a task of a non-whitelisted algorithm. The node will then execute it because the parent_id that is set prevents checks from being run. Relevant node code here

This impacts all servers that are breached by an expert user

Patches

Fixed in v4.1.2

Workarounds

None

Permalink: https://github.com/advisories/GHSA-vc3v-ppc7-v486
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12YzN2LXBwYzctdjQ4Ns4AA3K2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 14 days ago
Updated: 14 days ago

CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-vc3v-ppc7-v486, CVE-2023-47631
References:

• https://github.com/vantage6/vantage6/security/advisories/GHSA-vc3v-ppc7-v486
• https://nvd.nist.gov/vuln/detail/CVE-2023-47631
• https://github.com/vantage6/vantage6/commit/bf83521eb12fa80aa5fc92ef1692010a9a7f8243
• https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268
• https://github.com/advisories/GHSA-vc3v-ppc7-v486

Affected Packages