Homepage

feast@0.66.0.dev59

Python SDK for Feast

  • latest version

    0.66.0.dev69

  • first published

    7 years ago

  • latest version published

    18 hours ago

  • licenses detected

  • View feast package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the feast package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Missing Authentication for Critical Function

    feast is a Python SDK for Feast

    Affected versions of this package are vulnerable to Missing Authentication for Critical Function through the feature-server, registry-server, and offline-server endpoints when the default no_auth configuration leaves no security manager installed. An attacker can gain unauthorized access, execute arbitrary code, and trigger denial of service by sending requests to these exposed endpoints, including storing a malicious User-Defined Function on the feature-server or forcing re-materialization of all tenant features. This exposes cross-tenant feature data and can disrupt service for affected users and tenants.

    Notes

    • The issue was originally reported for RedHat's fork of Feast at red-hat-data-services/feast

    How to fix Missing Authentication for Critical Function?

    There is no fixed version for feast.

    [0,)
    • H
    Incorrect Behavior Order: Early Amplification

    feast is a Python SDK for Feast

    Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Amplification in the /materialize and /materialize-incremental endpoints. An attacker can trigger a full re-materialization of all feature views, causing denial of service, by sending a specially crafted request that omits the feature_views field. This bypasses the intended permission checks for those endpoints and can be exercised by an unauthenticated remote attacker or any authenticated user. The result is significant resource consumption and data corruption that disrupts service for all tenants.

    Notes

    • The issue was originally reported for RedHat's fork of Feast at red-hat-data-services/feast

    How to fix Incorrect Behavior Order: Early Amplification?

    There is no fixed version for feast.

    [0,)
    • H
    Deserialization of Untrusted Data

    feast is a Python SDK for Feast

    Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the registry’s user-defined function handling in the registry server and feature server components. An attacker can execute arbitrary code by storing a malicious serialized UDF in the registry and causing it to be deserialized. In default deployments, this leads to unauthenticated code execution on the feature server, and an authenticated attacker can also execute code on the registry server by abusing the deserialization path, enabling cross-tenant data access and lateral movement.

    Notes

    • The issue was originally reported for RedHat's fork of Feast at red-hat-data-services/feast

    How to fix Deserialization of Untrusted Data?

    There is no fixed version for feast.

    [0,)
    • M
    Origin Validation Error

    feast is a Python SDK for Feast

    Affected versions of this package are vulnerable to Origin Validation Error due to improper CORS configuration on the server. An attacker can bypass security controls and potentially access sensitive information by sending requests from unauthorized origins.

    How to fix Origin Validation Error?

    There is no fixed version for feast.

    [0,)
    Go back to all versions of this package