vantage6 vulnerable to username timing attack

LOW 3.7CVE-2024-21671 · GHSA-45gq-q4xh-cp53 · PYSEC-2024-31 · Published 30/01/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
vantage6 PyPI	`< 4.2.0`	`4.2.0`
vantage6-server PyPI	`< 4.2.0`	`4.2.0`
vantage6 vantage6	`< 4.2.0`	`4.2.0`

Description

Impact

It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks

Workarounds

NVD description

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.

References

vantage6/vantage6 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-21671 · ADVISORY
vantage6/vantage6 commit 389f416 · WEB
pypa/advisory-database · WEB
vantage6/vantage6 · PACKAGE
pypi.org/project/vantage6-server · PACKAGE
GitHub Advisory GHSA-45gq-q4xh-cp53 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free