CVE-2023-41881: Deleting a collaboration should also delete linked resources
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.
Other sources
When a collaboration is deleted in vantage6, the linked resources (such as tasks from that collaboration) are not properly deleted.
This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases, resulting in information disclosure.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-41881?
CVE-2023-41881 is a vulnerability in vantage6, a privacy preserving federated learning infrastructure, where linked resources are not properly deleted when a collaboration is deleted.
What is the severity of CVE-2023-41881?
The severity of CVE-2023-41881 is low with a CVSS score of 3.7.
How does CVE-2023-41881 affect vantage6?
CVE-2023-41881 affects vantage6 by not properly deleting linked resources when a collaboration is deleted.
How can I fix CVE-2023-41881?
To fix CVE-2023-41881, upgrade to vantage6 version 4.0.0 or later.
Where can I find more information about CVE-2023-41881?
More information about CVE-2023-41881 can be found at the following references: [GitHub Release Notes](https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400), [GitHub Pull Request](https://github.com/vantage6/vantage6/pull/748), [GitHub Security Advisory GHSA-rf54-7qrr-96j6](https://github.com/vantage6/vantage6/security/advisories/GHSA-rf54-7qrr-96j6).