CVE-2024-21649: Remote code execution
Impact Authenticated users could inject code into algorithm environment variables
Workarounds No
Other sources
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution. This vulnerability is patched in 4.2.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vantage6to a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
vantage6 technologyto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21649?
CVE-2024-21649 is considered a moderate severity vulnerability due to its potential for code injection by authenticated users.
How do I fix CVE-2024-21649?
To fix CVE-2024-21649, upgrade to version 4.2.0 or later of the vantage6 software.
Who is affected by CVE-2024-21649?
CVE-2024-21649 affects all users of the vantage6 software prior to version 4.2.0.
What kind of attack can CVE-2024-21649 enable?
CVE-2024-21649 can enable authenticated users to inject malicious code into algorithm environment variables.
Is there a workaround for CVE-2024-21649?
There are no known workarounds for CVE-2024-21649, so upgrading is essential.