vantage6 may create unencrypted tasks in encrypted collaboration

TRUNG BÌNH 4.3CVE-2024-22193 · GHSA-rjmv-52mp-gjrr · PYSEC-2024-32 · Công bố 30/01/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-22193 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng vantage6, vantage6 (vantage6).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.26%, cao hơn 17.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.2.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
vantage6 PyPI	`< 4.2.0`	`4.2.0`
vantage6 vantage6	`< 4.2.0`	`4.2.0`

Mô tả

Impact

There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database.

Workarounds

This is not an issue with the normal workflow, only if e.g. a user with the python client sets encryption to the wrong value.

Mô tả của NVD

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0.