Advisories for Pypi/Rasa-Pro package

Vulnerability A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This impacts the following connectors: audiocodes_stream genesys jambonz As part of our investigation to resolve this issue, we have also performed a …

Vulnerability A vulnerability has been identified in Rasa Pro and Rasa Open Source that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prerequisites for this are: The HTTP API must be enabled on the Rasa instance eg with –enable-api. This is not the default configuration. For unauthenticated RCE to be exploitable, the user must …