CVE-2023-23930CWE-502

vantage6's Pickle serialization is insecure

Medium · published October 11, 2023

CVSS v3.1
5.5
EPSS
1%
Percentile
65.6
In the wild
Unconfirmed
What it is

vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01108 · 65.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2023-10-11T17:39Z
EPSS history
Timeline
  • 11 OCT 17:39Z
    vantage6's Pickle serialization is insecure
    cvelistv5