Critical
MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue
Type: advisorySources: OSV
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-38699
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 17:48 UTC · Revision 1
Source evidence
MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue
core-osv · Original sourcePublished 4 Aug 2023, 17:53 UTC
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
osv:CVE-2023-38699
Complete source record
{
"id": "1a41cb17f41ea619e4468c4c284db5a9bfa20c178a2240412018b8155acda05a",
"url": "https://osv.dev/vulnerability/CVE-2023-38699",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue",
"summary": "MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.",
"evidence": "osv:CVE-2023-38699",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2023-38699",
"aliases": [
"CVE-2023-38699",
"GHSA-8hx6-qv6f-xgcw",
"PYSEC-2023-140"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mindsdb/mindshub",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "042c7a8bb0991ba7da33e79d3d6f8e1ba36b2f39"
},
{
"fixed": "083afcf6567cf51aa7d89ea892fd97689919053b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "23.7.4.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "083afcf6567cf51aa7d89ea892fd97689919053b"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "042c7a8bb0991ba7da33e79d3d6f8e1ba36b2f39"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v23.7.4.0"
}
]
}
}
],
"versions": [
"v23.7.3.1",
"v23.7.3.0",
"v23.7.2.0",
"v23.7.1.0",
"v23.6.5.1",
"v23.6.5.0",
"v23.6.4.0",
"v23.6.3.1",
"v23.6.3.0",
"v23.6.2.0",
"v23.6.1.1",
"v23.5.4.1",
"v23.5.3.2",
"v23.5.3.1",
"v23.4.4.4",
"v23.4.4.3",
"v23.4.4.2",
"v23.4.4.1",
"v23.4.4.0",
"v23.4.3.2",
"v23.4.3.1",
"v23.4.3.0",
"v23.3.5.0",
"v23.3.4.0",
"v23.3.3.5",
"v23.3.3.4",
"v23.3.3.3",
"v23.3.3.2",
"v23.3.3.1",
"v23.3.3.0",
"v23.3.2.0",
"v23.2.4.3",
"v23.2.4.2",
"v23.2.4.1",
"v23.2.4.0",
"v23.2.3.1",
"v23.2.3.0",
"v23.2.2.1",
"v23.2.2.0",
"v23.2.1.0",
"v23.1.5.0",
"v23.1.3.2",
"v23.1.3.1",
"v23.1.3.0",
"v22.12.4.3",
"v22.12.4.2",
"v22.12.4.0",
"v22.11.4.3",
"v22.11.4.2",
"v22.11.4.1",
"v22.11.4.0",
"v22.5.1.2",
"v2.45.2",
"v2.45.1",
"v2.45.0",
"v2.44.0",
"v2.43.0",
"v2.42.2",
"v2.42.1",
"v2.42.0",
"v2.41.2",
"v2.41.1",
"v2.41.0",
"v2.40.0",
"v2.39.0",
"2.38.0",
"2.37.0",
"2.36.0v2",
"2.36.0",
"v2.35.0",
"2.33.0",
"2.31.0",
"v2.30.1",
"2.30.0",
"v2.27.0",
"v2.26.0",
"2.21.2",
"2.21.1",
"2.21.0",
"2.20.1",
"v2.17.1",
"v2.15.0",
"v2.14.0",
"2.14.0",
"v2.11.2",
"v2.11.1",
"v2.11.0",
"v2.10.2",
"v2.10.0",
"v2.9.1",
"v2.9.0",
"v2.8.3",
"v2.8.1",
"v2.8.0",
"v2.7.2",
"v2.7.1",
"v2.7.0",
"v2.6.1",
"v2.6.0",
"v2.5.0",
"v2.4.0",
"v2.3.0",
"v2.2.1",
"v2.2.0",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.0.0",
"v1.0.6",
"v0.8.9.1",
"v0.8.8"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-38699.json"
}
}
],
"modified": "2026-10-28T02:30:30.999968590Z",
"provider": "osv",
"references": [
"https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38699.json",
"https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw",
"https://nvd.nist.gov/vuln/detail/CVE-2023-38699",
"https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b"
],
"provider_metadata": {
"cwe_ids": [
"CWE-311"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38699.json"
}
},
"related_cves": [
{
"value": "CVE-2023-38699",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 498007,
"published_at": "2023-08-04T17:53:30.604+00:00"
}