GHSA-rf54-7qrr-96j6
vantage6 does not properly delete linked resources when deleting a collaboration
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
When a collaboration is deleted in vantage6, the linked resources (such as tasks from that collaboration) are not properly deleted.
This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases, resulting in information disclosure.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/vantage6/vantage6/security/advisories/GHSA-rf54-7qrr-96j6
- https://nvd.nist.gov/vuln/detail/CVE-2023-41881
- https://github.com/vantage6/vantage6/pull/748
- https://github.com/vantage6/vantage6/commit/cce9538f8b70e814c080dd0ae43b297f3af8a732
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-200.yaml
- https://github.com/vantage6/vantage6
- https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400