CVE-2024-21671

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this...

CVE-2024-21671

creationtimestamp| type| source ---|---|--- 2024-01-30 17:21:58+00:00| seen| https://t.me/ctinow/176103...

vantage6-node (3.4.1a2), vantage6-server (3.4.1a2) potentially affected by CVE-2024-21671 via vantage6 (3.4.1a2)

vantage6 PYPI version 3.4.1a2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.4.1a2 - vantage6-server 3.4.1a2 Source cves: CVE-2024-21671 Source advisory: OSV:PYSEC-2024-31...

vantage6-node (3.3.8a6), vantage6-server (3.3.8a6) potentially affected by CVE-2024-21671 via vantage6 (3.3.8a6)

vantage6 PYPI version 3.3.8a6 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.3.8a6 - vantage6-server 3.3.8a6 Source cves: CVE-2024-21671 Source advisory: OSV:PYSEC-2024-31...

vantage6-node (3.3.0rc2), vantage6-server (3.3.0rc2) potentially affected by CVE-2024-21671 via vantage6 (3.3.0rc2)

vantage6 PYPI version 3.3.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.3.0rc2 - vantage6-server 3.3.0rc2 Source cves: CVE-2024-21671 Source advisory: OSV:PYSEC-2024-31...

vantage6-node (3.3.3), vantage6-server (3.3.3) potentially affected by CVE-2024-21671 via vantage6 (3.3.3)

vantage6 PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.3.3 - vantage6-server 3.3.3 Source cves: CVE-2024-21671 Source advisory: OSV:PYSEC-2024-31...

vantage6-node (3.8.5), vantage6-server (3.8.5) potentially affected by CVE-2024-21671 via vantage6 (3.8.5)

vantage6 PYPI version 3.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.8.5 - vantage6-server 3.8.5 Source cves: CVE-2024-21671 Source advisory: OSV:PYSEC-2024-31...

CVE-2024-21671 vantage6 username timing attack

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this...

CVE-2024-21671

The CVE-2024-21671 entry describes a username timing attack in the vantage6 login flow. Attackers could infer valid usernames from login response timing, aiding credential-based attacks. The issue is documented for vantage6 and is addressed by upgrading to version 4.2.0, which patches the vulnera...