Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/vantage6-server@4.0.1rc2
Typepypi
Namespace
Namevantage6-server
Version4.0.1rc2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.11.0
Latest_non_vulnerable_version4.11.0
Affected_by_vulnerabilities
0
url VCID-27hu-bwc5-43ca
vulnerability_id VCID-27hu-bwc5-43ca
summary The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. The vulnerability can be mitigated by removing the ssh part from the docker file and rebuilding the docker image. Version 4.2.0 patches the vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-21653
reference_id
reference_type
scores
0
value 0.00226
scoring_system epss
scoring_elements 0.45464
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-21653
1
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2024-34.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2024-34.yaml
2
reference_url https://github.com/vantage6/vantage6
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vantage6/vantage6
3
reference_url https://github.com/vantage6/vantage6/commit/3fcc6e6a8bd1142fd7a558d8fdd2b246e55c8841
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-23T18:07:24Z/
url https://github.com/vantage6/vantage6/commit/3fcc6e6a8bd1142fd7a558d8fdd2b246e55c8841
4
reference_url https://github.com/vantage6/vantage6/security/advisories/GHSA-2wgc-48g2-cj5w
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-23T18:07:24Z/
url https://github.com/vantage6/vantage6/security/advisories/GHSA-2wgc-48g2-cj5w
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-21653
reference_id CVE-2024-21653
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-21653
6
reference_url https://github.com/advisories/GHSA-2wgc-48g2-cj5w
reference_id GHSA-2wgc-48g2-cj5w
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2wgc-48g2-cj5w
fixed_packages
0
url pkg:pypi/vantage6-server@4.2.0
purl pkg:pypi/vantage6-server@4.2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-jg3m-kfzz-d3gp
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/vantage6-server@4.2.0
aliases CVE-2024-21653, GHSA-2wgc-48g2-cj5w, PYSEC-2024-33, PYSEC-2024-34
risk_score 4.4
exploitability 0.5
weighted_severity 8.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-27hu-bwc5-43ca
1
url VCID-g2kx-nbgv-jffy
vulnerability_id VCID-g2kx-nbgv-jffy
summary vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-47631
reference_id
reference_type
scores
0
value 0.00325
scoring_system epss
scoring_elements 0.55772
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-47631
1
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-node/PYSEC-2023-303.yaml
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-node/PYSEC-2023-303.yaml
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2023-304.yaml
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2023-304.yaml
3
reference_url https://github.com/vantage6/vantage6
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vantage6/vantage6
4
reference_url https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268
5
reference_url https://github.com/vantage6/vantage6/commit/bf83521eb12fa80aa5fc92ef1692010a9a7f8243
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vantage6/vantage6/commit/bf83521eb12fa80aa5fc92ef1692010a9a7f8243
6
reference_url https://github.com/vantage6/vantage6/security/advisories/GHSA-vc3v-ppc7-v486
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
3
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vantage6/vantage6/security/advisories/GHSA-vc3v-ppc7-v486
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-47631
reference_id CVE-2023-47631
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-47631
8
reference_url https://github.com/advisories/GHSA-vc3v-ppc7-v486
reference_id GHSA-vc3v-ppc7-v486
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vc3v-ppc7-v486
fixed_packages
0
url pkg:pypi/vantage6-server@4.1.2
purl pkg:pypi/vantage6-server@4.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27hu-bwc5-43ca
1
vulnerability VCID-jg3m-kfzz-d3gp
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/vantage6-server@4.1.2
aliases CVE-2023-47631, GHSA-vc3v-ppc7-v486, PYSEC-2023-303, PYSEC-2023-304
risk_score 4.0
exploitability 0.5
weighted_severity 7.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g2kx-nbgv-jffy
2
url VCID-jg3m-kfzz-d3gp
vulnerability_id VCID-jg3m-kfzz-d3gp
summary vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is fixed in 4.11.0.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43866
reference_id
reference_type
scores
0
value 0.00274
scoring_system epss
scoring_elements 0.51
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43866
1
reference_url https://github.com/vantage6/vantage6
reference_id
reference_type
scores
0
value 1.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vantage6/vantage6
2
reference_url https://github.com/vantage6/vantage6/commit/e39a262faf1cd4c554bf1b8e57eeea082da995c0
reference_id
reference_type
scores
0
value 1.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vantage6/vantage6/commit/e39a262faf1cd4c554bf1b8e57eeea082da995c0
3
reference_url https://github.com/vantage6/vantage6/security/advisories/GHSA-m3mq-f375-5vgh
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value 1.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-13T14:05:57Z/
url https://github.com/vantage6/vantage6/security/advisories/GHSA-m3mq-f375-5vgh
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43866
reference_id
reference_type
scores
0
value 1.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43866
5
reference_url https://github.com/advisories/GHSA-m3mq-f375-5vgh
reference_id GHSA-m3mq-f375-5vgh
reference_type
scores
url https://github.com/advisories/GHSA-m3mq-f375-5vgh
fixed_packages
0
url pkg:pypi/vantage6-server@4.11.0
purl pkg:pypi/vantage6-server@4.11.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/vantage6-server@4.11.0
aliases CVE-2025-43866, GHSA-m3mq-f375-5vgh, PYSEC-2025-221
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jg3m-kfzz-d3gp
Fixing_vulnerabilities
Risk_score4.4
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/vantage6-server@4.0.1rc2