Defining resource name as integer may give unintended access in vantage6
Impact
Malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names.
One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id 13 is allowed to run tasks, and an attacker creates a username with username '13', they would be wrongly allowed to run an algorithm.
There may also be other places in the code where such a mixup of resource ID or name leads to issues. The best solution we see is therefore to check when resources are created or modified, that the resource name always starts with a character.
Patches
To be done, probably in v3.9
Workarounds
None
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | vantage6 | < 4.0.0 | 4.0.0 |
| Python (PyPI) | vantage6-node | < 4.0.0 | 4.0.0 |
References
- https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400
- https://github.com/vantage6/vantage6/security/advisories/GHSA-7x94-6g2m-3hp2
- https://github.com/vantage6/vantage6/pull/744
- https://nvd.nist.gov/vuln/detail/CVE-2023-28635
- https://github.com/vantage6/vantage6/commit/aacfc24548cbf168579d2e13b2ddaf8ded715d36
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-node/PYSEC-2023-198.yaml
- https://github.com/vantage6/vantage6
- https://pypi.org/project/vantage6
- https://github.com/advisories/GHSA-7x94-6g2m-3hp2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-863- Platform
- Python (PyPI)
- Package
vantage6, vantage6-node- Disclosed
- 11.10.2023
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2023-198 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-2006 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-7x94-6g2m-3hp2 - CC BY 4.0
Vulnerability history: vantage6-node
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 10.2023 01.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 2
Disclosures per year
- 2023: 2
- 2024: 1
- 2025: 0
- 2026: 0
-
Defining resource name as integer may give unintended access in vantage6 this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.