Search for packages
| purl | pkg:pypi/vantage6@4.0.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-cc7t-us5t-ffbb
Aliases: CVE-2025-43863 GHSA-j6g5-p62x-58hw PYSEC-2025-220 |
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11. |
Affected by 0 other vulnerabilities. |
|
VCID-hdj5-dmqq-cqdp
Aliases: CVE-2024-21671 GHSA-45gq-q4xh-cp53 PYSEC-2024-31 |
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability. |
Affected by 1 other vulnerability. |
|
VCID-sgwu-s2e9-7qbp
Aliases: CVE-2024-21649 GHSA-w9h2-px87-74vx PYSEC-2024-30 |
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution. This vulnerability is patched in 4.2.0. |
Affected by 1 other vulnerability. |
|
VCID-tjnd-7tza-1fay
Aliases: CVE-2024-22193 GHSA-rjmv-52mp-gjrr PYSEC-2024-32 |
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-a33e-xhz8-fkey | vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround. |
CVE-2023-23930
GHSA-5m22-cfq9-86x6 PYSEC-2023-196 |