Defining resource name as integer may give unintended access in vantage6
Impact
Malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names.
One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id 13 is allowed to run tasks, and an attacker creates a username with username '13', they would be wrongly allowed to run an algorithm.
There may also be other places in the code where such a mixup of resource ID or name leads to issues. The best solution we see is therefore to check when resources are created or modified, that the resource name always starts with a character.
Patches
To be done, probably in v3.9
Workarounds
None
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | vantage6 | < 4.0.0 | 4.0.0 |
| Python (PyPI) | vantage6-node | < 4.0.0 | 4.0.0 |
Referencias
- https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400
- https://github.com/vantage6/vantage6/security/advisories/GHSA-7x94-6g2m-3hp2
- https://github.com/vantage6/vantage6/pull/744
- https://nvd.nist.gov/vuln/detail/CVE-2023-28635
- https://github.com/vantage6/vantage6/commit/aacfc24548cbf168579d2e13b2ddaf8ded715d36
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-node/PYSEC-2023-198.yaml
- https://github.com/vantage6/vantage6
- https://pypi.org/project/vantage6
- https://github.com/advisories/GHSA-7x94-6g2m-3hp2
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N- Debilidad (CWE)
CWE-863- Plataforma
- Python (PyPI)
- Paquete
vantage6, vantage6-node- Publicada
- 11.10.2023
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2023-198 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-2006 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-7x94-6g2m-3hp2 - CC BY 4.0
Historial de vulnerabilidades: vantage6-node
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 3
- Primera → última
- 10.2023 01.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 1
- Media 2
Divulgaciones por año
- 2023: 2
- 2024: 1
- 2025: 0
- 2026: 0
-
Defining resource name as integer may give unintended access in vantage6 esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.