Skip to content
ZenMLGHSA-c546-8jmq-hprj

Race condition in zenml

Low3.1CVE-2024-2032 · Published Jun 6, 2024 · updated Oct 14, 2024

GitHub advisory

Affected versions

PackageAffectedFixed in
zenml
PyPI
< 0.55.50.55.5
Details and references

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-362, CWE-366
Also known as
CVE-2024-2032, PYSEC-2024-105

More ZenML advisories

All ZenML
DateAdvisory
Jun 62024Improper authorization in zenml
CVE-2024-2035Medium6.5fixed in 0.56.2
Jun 62024Improper authentication in zenml
CVE-2024-2213Low3.3fixed in 0.56.3
Jun 62024Clickjacking in zenml
CVE-2024-2383Medium4.3fixed in 0.56.3
Jun 62024Cross site scripting in zenml
CVE-2024-2171Low3.4fixed in 0.56.2
Jun 82024zenml-io/zenml does not expire the session after password reset
CVE-2024-4680Low3.9no fix yet
Jun 242024Improper line feed handling in zenml
CVE-2024-4460Medium4.3fixed in 0.57.1

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.