CVSS 3.1
3.7 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2024-21671
Low (3.7) in vantage6 vantage6. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in vantage6-server 4.2.0.
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-203, CWE-208
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vantage6:vantage6
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-45gq-q4xh-cp53 | PyPI | vantage6-server | <4.2.0 | 4.2.0 |
| PYSEC-2024-31 | PyPI | vantage6 | <4.2.0 | 4.2.0 |
| PYSEC-2026-2008 | PyPI | vantage6-server | <4.2.0 | 4.2.0 |
References
- https://github.com/vantage6/vantage6/commit/389f416c445da4f2438c72f34c3b1084485c4e30
- https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53
- https://github.com/vantage6/vantage6/commit/389f416c445da4f2438c72f34c3b1084485c4e30
- https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53