{"id":"CVE-2024-21671","published":"2024-01-30T15:43:06Z","modified":"2024-10-17T18:01:07Z","title":"vantage6 username timing attack","vendor":"vantage6","product":"vantage6","tier":"tail","description":{"text":"The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks.  Version 4.2.0 patches this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00401,"percentile":0.34398,"provenance":"source"},"cwes":[{"id":"CWE-208","name":"Observable Timing Discrepancy"}],"references":[{"url":"https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vantage6/vantage6/commit/389f416c445da4f2438c72f34c3b1084485c4e30","tags":["x_refsource_MISC"]}],"priority":{"score":9.5,"factors":[{"name":"EPSS percentile","points":6.88},{"name":"CVSS severity","points":2.59}]},"vendorSlug":"vantage6","affectedVersions":[{"vendor":"vantage6","product":"vantage6","versions":["< 4.2.0"]}],"affected":[{"ecosystem":"PyPI","package":"vantage6-server","vulnerableRanges":["<4.2.0"],"patched":["4.2.0"],"from":["GHSA-45gq-q4xh-cp53","PYSEC-2026-2008"],"provenance":"source"},{"ecosystem":"PyPI","package":"vantage6","vulnerableRanges":["<4.2.0"],"patched":["4.2.0"],"from":["PYSEC-2024-31"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0170","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vantage6-cve-2024-21671","children":[{"from":"CVE-2024-21671","to":"CVE-2024-24770","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-45gq-q4xh-cp53","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-5h3x-6gwf-73jm","via":"reference","url":"https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-2005","via":"reference","url":"https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53"}]}],"packageHistory":[{"cve":"CVE-2023-47631","published":"2023-11-14","fixed":"4.1.2","kev":false,"link":{"from":"CVE-2023-47631","to":"CVE-2024-21671","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:vantage6-server","fromFixed":"4.1.2","toFixed":"4.2.0","daysApart":77}]}},{"cve":"CVE-2024-21653","published":"2024-01-30","fixed":"4.2.0","kev":false},{"cve":"CVE-2024-21671","published":"2024-01-30","fixed":"4.2.0","kev":false},{"cve":"CVE-2024-23823","published":"2024-03-14","fixed":"4.2.1","kev":false,"link":{"from":"CVE-2024-21671","to":"CVE-2024-23823","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:vantage6-server","fromFixed":"4.2.0","toFixed":"4.2.1","daysApart":44}]}},{"cve":"CVE-2025-43866","published":"2025-06-12","fixed":"4.11.0","kev":false}],"package":"PyPI:vantage6-server"}}