id: PYSEC-2024-105
modified: 2024-10-11T17:21:29.672975Z
published: 2024-06-06T19:15:00Z
aliases:
- CVE-2024-2032
- GHSA-c546-8jmq-hprj
details: A race condition vulnerability exists in zenml-io/zenml versions up to and
  including 0.55.3, which allows for the creation of multiple users with the same
  username when requests are sent in parallel. This issue was fixed in version 0.55.5.
  The vulnerability arises due to insufficient handling of concurrent user creation
  requests, leading to data inconsistencies and potential authentication problems.
  Specifically, concurrent processes may overwrite or corrupt user data, complicating
  user identification and posing security risks. This issue is particularly concerning
  for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race,
  where it could lead to further complications.
affected:
- package:
    ecosystem: PyPI
    name: zenml
    purl: pkg:pypi/zenml
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: afcaf741ef9114c9b32f722f101b97de3d8d147b
    repo: https://github.com/zenml-io/zenml
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.55.5
  versions:
  - 0.0.1rc1
  - 0.0.1rc2
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.3rc0
  - 0.1.4
  - 0.1.5
  - 0.10.0
  - 0.11.0
  - 0.12.0
  - 0.13.0
  - 0.13.1
  - 0.13.2
  - 0.2.0
  - 0.2.0rc1
  - 0.2.0rc2
  - 0.20.0
  - 0.20.0rc1
  - 0.20.1
  - 0.20.2
  - 0.20.3
  - 0.20.4
  - 0.20.5
  - 0.21.0
  - 0.21.1
  - 0.22.0
  - 0.23.0
  - 0.3.1
  - 0.3.1rc0
  - 0.3.2
  - 0.3.3
  - 0.3.3rc0
  - 0.3.4
  - 0.3.4rc0
  - 0.3.5
  - 0.3.5rc0
  - 0.3.6
  - 0.3.6.1
  - 0.3.6rc0
  - 0.3.7
  - 0.3.7.1rc0
  - 0.3.7.1rc1
  - 0.3.7.1rc3
  - 0.3.7.1rc4
  - 0.3.7rc0
  - 0.3.8
  - 0.3.9rc1
  - 0.3.9rc2
  - 0.30.0
  - 0.30.0rc0
  - 0.30.0rc1
  - 0.30.0rc2
  - 0.30.0rc3
  - 0.31.0
  - 0.31.1
  - 0.32.0
  - 0.32.1
  - 0.33.0
  - 0.34.0
  - 0.35.0
  - 0.35.1
  - 0.36.0
  - 0.36.1
  - 0.37.0
  - 0.38.0
  - 0.39.0
  - 0.39.1
  - 0.40.0
  - 0.40.1
  - 0.40.2
  - 0.40.3
  - 0.41.0
  - 0.42.0
  - 0.42.1
  - 0.42.2
  - 0.43.0
  - 0.43.1
  - 0.44.0
  - 0.44.1
  - 0.44.2
  - 0.44.3
  - 0.44.4
  - 0.45.0
  - 0.45.1
  - 0.45.2
  - 0.45.3
  - 0.45.4
  - 0.45.5
  - 0.45.6
  - 0.46.0
  - 0.46.1
  - 0.47.0
  - 0.5.0
  - 0.5.0rc1
  - 0.5.0rc2
  - 0.5.1
  - 0.5.2
  - 0.5.3
  - 0.5.4
  - 0.5.5
  - 0.5.6
  - 0.5.7
  - 0.50.0
  - 0.51.0
  - 0.52.0
  - 0.53.0
  - 0.53.1
  - 0.54.0
  - 0.54.1
  - 0.55.0
  - 0.55.1
  - 0.55.2
  - 0.55.3
  - 0.55.4
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.8.0
  - 0.8.1
  - 0.8.1rc0
  - 0.9.0
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
references:
- type: WEB
  url: https://huntr.com/bounties/6199cd5d-611f-4ea9-96c5-52a952ba5a56
- type: FIX
  url: 
    https://github.com/zenml-io/zenml/commit/afcaf741ef9114c9b32f722f101b97de3d8d147b
- type: ADVISORY
  url: https://github.com/advisories/GHSA-c546-8jmq-hprj