by Kastro
Paper/Archive/CVE-2023-38699

CVE-2023-38699

mindsdb mindsdb — MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 22.3.223 × 204.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.

Affected

ProductAffectedFixed inSource
mindsdb< 23.7.4.0–CNA
mindsdb< 23.7.4.023.7.4.0CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcwrefgithub.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053brefgithub.com/mindsdb/mindsdb/releases/tag/v23.7.4.0