Vulnerability · Published Jan 30, 2024 · Assigned by GitHub_M
CVE-2024-21671vantage6 username timing attack
Low 3.7
In plain English
A low-severity security flaw in vantage6 from vantage6. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | vantage6 | 4.2.0 | PYSEC-2024-31 |
| PyPI | vantage6-server | 4.2.0 | GHSA-45gq-q4xh-cp53 |
| PyPI | vantage6-server | 4.2.0 | PYSEC-2026-2008 |
Affected products (as reported)
Weakness: CWE-208 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N