Lucene search

GoogleOSV:CVE-2024-21649

HistoryJan 30, 2024 - 4:15 p.m.

CVE-2024-21649

2024-01-3016:15:47

Google

osv.dev

vantage6

privacy enhancing

federated learning

multi-party computation

remote code execution

patched software

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.9%

JSON

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution. This vulnerability is patched in 4.2.0.

CPENameOperatorVersion
vantage6eqersion/3.5.0
vantage6eqersion/3.5.0rc3
vantage6eq3.4.2
vantage6eqersion/3.7.0rc2
vantage6eqersion/3.3.8a7
vantage6eqersion/3.4.0a2
vantage6eqersion/3.4.0a1
vantage6eqersion/3.4.3
vantage6eqersion/3.4.0a6
vantage6eq3.5.0

Name	Operator	Version
vantage6	eq	ersion/3.5.0
vantage6	eq	ersion/3.5.0rc3
vantage6	eq	3.4.2
vantage6	eq	ersion/3.7.0rc2
vantage6	eq	ersion/3.3.8a7
vantage6	eq	ersion/3.4.0a2
vantage6	eq	ersion/3.4.0a1
vantage6	eq	ersion/3.4.3
vantage6	eq	ersion/3.4.0a6
vantage6	eq	3.5.0

Rows per page:

1-10 of 1471

References

github.com/vantage6/vantage6/commit/eac19db737145d3ca987adf037a454fae0790ddd

github.com/vantage6/vantage6/security/advisories/GHSA-w9h2-px87-74vx

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.9%

JSON

Related for OSV:CVE-2024-21649