CVE-2023-38699
mediumpriority · track · 26OT risk · elevatedEPSS 0.003 · 22 %ileEUUSEPSS · scored 2026-10-27
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-8hx6-qv6f-xgcwMindsDB can be made to not verify SSL certificates2023-08-01ghsa · osvUS
### Summary MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior Encryption in general is typically critical to the security of many applications. Using TLS can significantly increase security by guaranteeing the identity of the party you are communicating with. This is accomplished by one or both parties presenting trusted certificates during the connection initialization phase of TLS. It is important to note that modules such as httplib within the Python standard library did not verify certificate chains until it was fixed in 2.7.9 release. ### Details Severity: Critical
- PYSEC-2023-1402023-08-04vendor · osvUS
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-38699/cnnvd
- https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053bcnnvd
- https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0cnnvd
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcwcnnvd
- https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053benisa_euvd
- https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0enisa_euvd
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcwenisa_euvd
- https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053bPatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan