CVE-2023-38699
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
MindsDB's AI Virtual Database prior to version 23.7.4.0 allowed disabling SSL certificate verification using `verify=False`. In version 23.7.4.0, SSL certificate verification is enabled by default, which is the desired behavior.
Risk Assessment
Lack of SSL certificate verification can lead to man-in-the-middle attacks, posing a serious threat to the security of data transmitted between the application and the data source.
Recommendation
It is recommended to upgrade to version 23.7.4.0 or later to ensure default SSL certificate verification.
Original NVD description (English source)
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.