vantage6 vulnerable to Observable Response Discrepancy

中 6.5CVE-2022-39228 · GHSA-36gx-9q6h-g429 · PYSEC-2023-313 · 01/03/2023 公開 · 17/06/2026 更新

要点

CVE-2022-39228 は vantage6, vantage6 (vantage6) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.60%（全脆弱性の 48.5% より高い）。
対処：3.8.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
vantage6 PyPI	`≥ 3.3.3, < 3.8.0< 3.8.0`	`3.8.0`
vantage6 vantage6	`≥ 3.3.3, < 3.8.0`	`3.8.0`

概要

Impact

We are incorporating the password policies listed in https://github.com/vantage6/vantage6/issues/59. One measure is that we don't let the user know in case of wrong username/password combination if the username actually exists, to prevent that bots can guess usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This way you could still find out which usernames exist.

Patches

Update to 3.8.0+

Workarounds

References

https://github.com/vantage6/vantage6/issues/59

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD の説明

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.