Threats tagged 'ghsa-gg2p-37pv-v7fq'

Feast versions prior to 0.67.0 contain a critical vulnerability due to unsafe deserialization of user-defined functions (UDFs) serialized with the 'dill' library. This flaw allows unauthenticated remote attackers to execute arbitrary code on the feature server under default configurations. Authenticated attackers can also bypass authorization checks to achieve arbitrary code execution on the registry server. The vulnerability enables cross-tenant data access and lateral movement within the system. A fix is available in version 0.67.0.