CVE-2020-25459

An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE ...

7.5 HighFix available

An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.04%Up 0.2 points since Jun 17, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2020-25459
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-668
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-25459
Updated: 2026-11-02

EUVDEUVD-2020-18145 No score

Record: EUVD-2020-18145
Updated: 2026-11-03

GitHub AdvisoriesGHSA-72c2-p2mr-mqr3 7.5

An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE ...

Record: GHSA-72c2-p2mr-mqr3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-668
Updated: 2026-11-02

OSV 7.5

Record: CVE-2020-25459
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2021-0049 No score

Updated crmsh packages fix security vulnerability

The crm configure and hb_report commands failed to sanitize sensitive information by default (bsc#1163581).

An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges (CVE-2020-25459).

The crmsh package has been updated to the latest git snapshot and patched for CVE-2020-25459, fixing these issues and several others.

Record: MGASA-2021-0049
Updated: 2026-11-02

Affected products

webank federated ai technology enabler

Affected packages

Affected packages
Package	Affected	Fixed
`crmsh` Mageia:7	before 4.2.0-0.39d42c2.1.1.mga7	4.2.0-0.39d42c2.1.1.mga7

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-25459 is a high vulnerability (CVSS 7.5) in Webank Federated Ai Technology Enabler, published January 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 64th percentile. Fixed in crmsh 4.2.0-0.39d42c2.1.1.mga7.