CVE-2024-21671

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-21671

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-21671.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2024-21671

Aliases

Published

2024-01-30T15:43:06Z

Modified

2026-10-22T10:34:12Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

vantage6 username timing attack

Details

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-208"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21671.json"
}

References

Affected packages

Git / github.com/vantage6/vantage6

Affected ranges

Type

GIT

Repo

https://github.com/vantage6/vantage6

Events

Introduced

Fixed

2067fc452977ce067838da6c5bd47733d8198aed

Fixed

389f416c445da4f2438c72f34c3b1084485c4e30

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:vantage6:vantage6:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.2.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "389f416c445da4f2438c72f34c3b1084485c4e30"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v3.*

v3.4.0

v3.4.0a2

v3.4.0a3

v3.4.0a4

v3.4.0a6

v3.4.1

v3.4.1a0

v3.4.1a1

v3.4.1a2

v3.4.1a3

v3.4.2

v3.4.2a0

v3.4.3

v3.5.0

v3.5.0rc2

v3.5.0rc3

v3.5.1

v3.5.2

v3.6.1

v3.6.1rc1

v3.6.1rc2

v3.6.1rc3

v3.7.0

v3.7.0rc1

v3.7.0rc2

v3.7.1

v3.7.2

v3.7.3

v3.8.0rc2

v3.8.0rc3

version/0.*

version/0.0.0b3

version/3.*

version/3.10.0

version/3.10.1

version/3.10.2

version/3.10.3

version/3.10.4

version/3.3.0

version/3.3.0rc1

version/3.3.0rc2

version/3.3.0rc3

version/3.3.0rc4

version/3.3.1

version/3.3.2

version/3.3.3

version/3.3.4

version/3.3.5

version/3.3.6

version/3.3.7

version/3.3.8a1

version/3.3.8a2

version/3.3.8a3

version/3.3.8a4

version/3.3.8a5

version/3.3.8a6

version/3.3.8a7

version/3.3.8a8

version/3.3.8a9

version/3.4.0

version/3.4.0a0

version/3.4.0a1

version/3.4.0a2

version/3.4.0a3

version/3.4.0a4

version/3.4.0a5

version/3.4.0a6

version/3.4.1

version/3.4.1a0

version/3.4.1a1

version/3.4.1a2

version/3.4.1a3

version/3.4.2

version/3.4.2a0

version/3.4.3

version/3.5.0

version/3.5.0rc2

version/3.5.0rc3

version/3.5.1

version/3.5.2

version/3.6.1

version/3.6.1rc1

version/3.6.1rc2

version/3.6.1rc3

version/3.7.0

version/3.7.0rc1

version/3.7.0rc2

version/3.7.1

version/3.7.2

version/3.7.3

version/3.8.0rc2

version/3.8.0rc3

version/3.9.0

version/3.9.0rc1

version/3.9.0rc2

version/3.9.0rc3

version/3.9.0rc4

version/4.*

version/4.0.3

version/4.1.0

version/4.1.1

version/4.1.2

version/4.1.2rc1

version/4.1.3

version/4.2.0rc1

version/4.2.0rc2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-21671.json"