CVE-2023-23930 — vantage6 is privacy preserving federated learning infrastructure
vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are aff
Published
2023-10-11T17:39:23.504Z
Last modified
2024-09-18T15:22:09.610Z
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
01What is this vulnerability?
vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround.
02Affected products
| Vendor | Product | Versions |
|---|
| vantage6 | vantage6 | < 4.0.0 |
03Active exploitation status
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
04Recommended remediation
- Patch to a fixed version listed in the vendor advisory (see references below).
- Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
- Hunt historical logs for exploitation indicators — see Detection signatures below.
05Technical details
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
06Detection signatures
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
07Related CVEs
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.
08Timeline
- Published: 2023-10-11T17:39:23.504Z
- Last modified: 2024-09-18T15:22:09.610Z
09References
- github.com — https://github.com/vantage6/vantage6/security/advisories/GHSA-5m22-cfq9-86x6
- github.com — https://github.com/vantage6/vantage6/commit/e62f03bacf2247bd59eed217e2e7338c3a01…
- github.com — https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f…
- medium.com — https://medium.com/ochrona/python-pickle-is-notoriously-insecure-d6651f1974c9
Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →