{"cve":"CVE-2024-21653","nvd":{"published":"2024-01-30T16:15:47.863","modified":"2026-06-17T07:09:56.040","status":"Modified","description":"The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive.  The vulnerability can be mitigated by removing the ssh part from the docker file and rebuilding the docker image.  Version 4.2.0 patches the vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-284"],"references":["https://github.com/vantage6/vantage6/commit/3fcc6e6a8bd1142fd7a558d8fdd2b246e55c8841","https://github.com/vantage6/vantage6/security/advisories/GHSA-2wgc-48g2-cj5w","https://github.com/vantage6/vantage6/commit/3fcc6e6a8bd1142fd7a558d8fdd2b246e55c8841","https://github.com/vantage6/vantage6/security/advisories/GHSA-2wgc-48g2-cj5w"],"products":["vantage6:vantage6"],"source":"nvd","synced_at":"2026-10-19T21:44:57.175229480+00:00"},"epss":{"cve":"CVE-2024-21653","score":0.0047,"percentile":0.40659,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-2wgc-48g2-cj5w","url":"https://osv.dev/vulnerability/GHSA-2wgc-48g2-cj5w","summary":"vantage6 has insecure SSH configuration for node and server containers","modified":"2026-09-10T03:50:04.655468127Z","packages":[{"ecosystem":"PyPI","name":"vantage6","purl":"pkg:pypi/vantage6","ranges":["<4.2.0"],"fixed":["4.2.0"]}]},{"id":"PYSEC-2024-33","url":"https://osv.dev/vulnerability/PYSEC-2024-33","summary":"","modified":"2026-07-07T17:56:25.281119153Z","packages":[{"ecosystem":"PyPI","name":"vantage6-node","purl":"pkg:pypi/vantage6-node","ranges":["<4.2.0"],"fixed":["4.2.0"]}]},{"id":"PYSEC-2024-34","url":"https://osv.dev/vulnerability/PYSEC-2024-34","summary":"","modified":"2026-07-07T17:56:25.281119153Z","packages":[{"ecosystem":"PyPI","name":"vantage6-server","purl":"pkg:pypi/vantage6-server","ranges":["<4.2.0"],"fixed":["4.2.0"]}]},{"id":"PYSEC-2026-2003","url":"https://osv.dev/vulnerability/PYSEC-2026-2003","summary":"vantage6 has insecure SSH configuration for node and server containers","modified":"2026-07-07T17:56:25.281119153Z","packages":[{"ecosystem":"PyPI","name":"vantage6","purl":"pkg:pypi/vantage6","ranges":["<4.2.0"],"fixed":["4.2.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}