CVE-2024-21671: vantage6 username timing attack
Impact It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks
Workarounds No
Other sources
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vantage6-serverto a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
vantage6 username timing attackto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21671?
CVE-2024-21671 is categorized as a medium severity vulnerability due to the potential exposure of usernames through login request timing.
How do I fix CVE-2024-21671?
To mitigate CVE-2024-21671, upgrade the vantage6-server package to version 4.2.1 or later.
What types of attacks does CVE-2024-21671 facilitate?
CVE-2024-21671 could aid credential stuffing or brute force attacks by revealing valid usernames based on response times.
Which versions of the vantage6 software are affected by CVE-2024-21671?
CVE-2024-21671 affects the vantage6-server versions up to and including 4.2.0.
Is there a workaround for CVE-2024-21671?
There are currently no effective workarounds for CVE-2024-21671 other than updating to a fixed version.