PT-2024-19000 · Vantage6 · Vantage6

Bartvanb · Published 2024-01-30 · Updated 2024-02-08 · CVE-2024-21653

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 4.2.0

Description The vantage6 technology is used to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). By default, nodes and servers receive an ssh config that permits root login with password authentication. Although a proper deployment should not expose the SSH service, not all deployments are ideal, and the default configuration should be less permissive.

Recommendations For versions prior to 4.2.0, remove the ssh part from the docker file and rebuild the docker image as a mitigation measure. For version 4.2.0 and later, no action is required as this version patches the vulnerability.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-21653

GHSA-2WGC-48G2-CJ5W

PYSEC-2024-33

PYSEC-2024-34

Affected Products

Vantage6

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21653.json · Exploit
• https://github.com/vantage6/vantage6/security/advisories/GHSA-2wgc-48g2-cj5w · Vendor Advisory
• https://github.com/vantage6/vantage6/commit/3fcc6e6a8bd1142fd7a558d8fdd2b246e55c8841 · Patch
• https://osv.dev/vulnerability/GHSA-2wgc-48g2-cj5w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21653 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-34 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-33 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2024-34.yaml · Note
• https://github.com/vantage6/vantage6 · Note
• https://twitter.com/VulmonFeeds/status/1752382995321790701 · Twitter Post
• https://twitter.com/CVEnew/status/1752359083254947979 · Twitter Post
• https://t.me/cvenotify/70619 · Telegram Post