CVE-2024-21671

CVSS V2 None CVSS V3 None

Description

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.

Overview

CVE ID
CVE-2024-21671

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-01-30T15:43:06.789Z

Last Modified Date
2024-01-30T15:43:06.789Z

Weakness Enumerations

CWE	URL
CWE-208	http://cwe.mitre.org/data/definitions/208.html

References

Reference URL	Reference Tags
https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53	x_refsource_CONFIRM
https://github.com/vantage6/vantage6/commit/389f416c445da4f2438c72f34c3b1084485c4e30	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-21671
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21671

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 15:23:46				Added to TrackCVE