Race condition in zenml
Low3.1CVE-2024-2032 · Published Jun 6, 2024 · updated Oct 14, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| zenml PyPI | < 0.55.5 | 0.55.5 |
Details and references
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.
More ZenML advisories
All ZenML| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 62024 | Improper authorization in zenml CVE-2024-2035Medium6.5fixed in 0.56.2 | Medium6.5 | 0.56.2 |
| Jun 62024 | Improper authentication in zenml CVE-2024-2213Low3.3fixed in 0.56.3 | Low3.3 | 0.56.3 |
| Jun 62024 | Clickjacking in zenml CVE-2024-2383Medium4.3fixed in 0.56.3 | Medium4.3 | 0.56.3 |
| Jun 62024 | Cross site scripting in zenml CVE-2024-2171Low3.4fixed in 0.56.2 | Low3.4 | 0.56.2 |
| Jun 82024 | zenml-io/zenml does not expire the session after password reset CVE-2024-4680Low3.9no fix yet | Low3.9 | No fix yet |
| Jun 242024 | Improper line feed handling in zenml CVE-2024-4460Medium4.3fixed in 0.57.1 | Medium4.3 | 0.57.1 |