{
  "schema_version": "1.4.0",
  "id": "GHSA-w7qg-j435-78qw",
  "modified": "2023-04-06T22:53:10Z",
  "published": "2023-03-30T12:30:15Z",
  "aliases": [
    "CVE-2023-1712"
  ],
  "summary": "Use of hard-coded, security-relevant constants in deepset-ai/haystack",
  "details": "Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "farm-haystack"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.15.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1712"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepset-ai/haystack/pull/4535"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepset-ai/haystack/commit/5fc84904f198de661d5b933fde756aa922bf09f1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/deepset-ai/haystack"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/9a6b1fb4-ec9b-4cfa-af1e-9ce304924829"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-547"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-30T22:55:51Z",
    "nvd_published_at": "2023-03-30T10:15:00Z"
  }
}