GHSA-rjmv-52mp-gjrr: vantage6 may create unencrypted tasks in encrypted collaboration

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-22193

vantage6 may create unencrypted tasks in encrypted collaboration

Low severity GitHub Reviewed Published Jan 30, 2024 in vantage6/vantage6 • Updated Jan 30, 2024

Package

pip vantage6 (pip)

Affected versions

< 4.2.0

Description

Impact

There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database.

Workarounds

This is not an issue with the normal workflow, only if e.g. a user with the python client sets encryption to the wrong value.

References

• GHSA-rjmv-52mp-gjrr
• https://nvd.nist.gov/vuln/detail/CVE-2024-22193
• vantage6/vantage6@6383283

Published to the GitHub Advisory Database

Jan 30, 2024

Last updated

Jan 30, 2024