{"id":"CVE-2020-25459","aliases":["EUVD-2020-18145","GHSA-72c2-p2mr-mqr3","MGASA-2021-0049"],"status":"published","title":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE ...","description":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01045,"percentile":0.64387,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-668"],"published":"2021-01-22T23:50:14Z","modified":"2026-10-20T10:52:53Z","fixes":[{"ecosystem":"Mageia:7","package":"crmsh","fixed_in":["4.2.0-0.39d42c2.1.1.mga7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"crmsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-0.39d42c2.1.1.mga7"}]}]}],"products":[{"vendor":"webank","product":"federated_ai_technology_enabler"}],"references":[{"url":"https://github.com/FederatedAI/FATE/commit/6feccf6d752184a6f9365d56a76fe627983e7139","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25459"},{"url":"https://github.com/advisories/GHSA-72c2-p2mr-mqr3"},{"url":"https://advisories.mageia.org/MGASA-2021-0049.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27444","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00032.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RKSUG2OZN3Y2FQVQ55HP5MZIQZXZ5OD6/","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-25459","description":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.","status":"published","published":"2022-06-16T20:36:30Z","modified":"2024-08-04T15:33:05.595Z","updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2020-18145","description":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.","status":"published","published":"2022-06-16T20:36:30Z","modified":"2024-08-04T15:33:05Z","updated_at":"2026-11-03T03:07:17.764085Z"}],"ghsa":[{"id":"GHSA-72c2-p2mr-mqr3","title":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE ...","description":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.","status":"published","published":"2022-06-17T00:01:22Z","modified":"2023-01-27T05:04:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:42:28.374431Z"}],"nvd":[{"id":"CVE-2020-25459","description":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.","status":"published","published":"2022-06-16T21:15:07.713Z","modified":"2026-06-17T03:06:49.523Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:06:46.951463Z"}],"osv":[{"id":"CVE-2020-25459","description":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.","status":"published","published":"2022-06-16T21:15:07.713Z","modified":"2026-10-20T10:52:53.346404799Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"MGASA-2021-0049","title":"Updated crmsh packages fix security vulnerability","description":"The crm configure and hb_report commands failed to sanitize sensitive\ninformation by default (bsc#1163581).\n\nAn issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers\nable to call \"crm history\" (when \"crm\" is run) were able to execute commands\nvia shell code injection to the crm history commandline, potentially allowing\nescalation of privileges (CVE-2020-25459).\n\nThe crmsh package has been updated to the latest git snapshot and patched for\nCVE-2020-25459, fixing these issues and several others.\n","status":"published","published":"2021-01-22T23:50:14Z","modified":"2026-04-16T04:43:00.682461869Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}