CVE-2023-38699
MindsDB can be made to not verify SSL certificates
9.1
CRITICAL
CVSS 3.1
EPSS 0.24%
描述
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
如何修補 CVE-2023-38699
要修補 CVE-2023-38699,請將受影響套件升級到下列已修補版本。
- —升級至 23.7.4.0 或更新版本
- —升級至 083afcf6567cf51aa7d89ea892fd97689919053b 或更新版本
CVE-2023-38699 正在被利用嗎?
低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 23.7.4.0
- from 0, < 083afcf6567cf51aa7d89ea892fd97689919053b | from 0, < 23.7.4.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |