vantage6 vulnerable to Observable Response Discrepancy

TRUNG BÌNH 6.5CVE-2022-39228 · GHSA-36gx-9q6h-g429 · PYSEC-2023-313 · Công bố 01/03/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-39228 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng vantage6, vantage6 (vantage6).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.60%, cao hơn 48.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.8.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
vantage6 PyPI	`≥ 3.3.3, < 3.8.0< 3.8.0`	`3.8.0`
vantage6 vantage6	`≥ 3.3.3, < 3.8.0`	`3.8.0`

Mô tả

Impact

We are incorporating the password policies listed in https://github.com/vantage6/vantage6/issues/59. One measure is that we don't let the user know in case of wrong username/password combination if the username actually exists, to prevent that bots can guess usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This way you could still find out which usernames exist.

Patches

Update to 3.8.0+

Workarounds

References

https://github.com/vantage6/vantage6/issues/59

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Mô tả của NVD

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.