CVE-2023-41881: Deleting a collaboration should also delete linked resources

Published Oct 11, 2023
·
Updated

vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.

Other sources

When a collaboration is deleted in vantage6, the linked resources (such as tasks from that collaboration) are not properly deleted.

This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases, resulting in information disclosure.

Affected Software

2 affected componentsFixes available
pip/vantage6<4.0.0
4.0.0
Vantage6 Vantage6<4.0.0

Event History

Oct 11, 2023
CVE Published
via MITRE·07:30 PM
Data Sourced
via MITRE·07:30 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 16, 2023
Advisory Published
02:31 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2023-41881?

CVE-2023-41881 is a vulnerability in vantage6, a privacy preserving federated learning infrastructure, where linked resources are not properly deleted when a collaboration is deleted.

2

What is the severity of CVE-2023-41881?

The severity of CVE-2023-41881 is low with a CVSS score of 3.7.

3

How does CVE-2023-41881 affect vantage6?

CVE-2023-41881 affects vantage6 by not properly deleting linked resources when a collaboration is deleted.

4

How can I fix CVE-2023-41881?

To fix CVE-2023-41881, upgrade to vantage6 version 4.0.0 or later.

5

Where can I find more information about CVE-2023-41881?

More information about CVE-2023-41881 can be found at the following references: [GitHub Release Notes](https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400), [GitHub Pull Request](https://github.com/vantage6/vantage6/pull/748), [GitHub Security Advisory GHSA-rf54-7qrr-96j6](https://github.com/vantage6/vantage6/security/advisories/GHSA-rf54-7qrr-96j6).

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203