PT-2024-19266 · Vantage6 · Vantage6

Lowbartvanb · Published 2024-01-30 · Updated 2024-02-08 · CVE-2024-22193

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 4.2.0

Description The vantage6 technology is used to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. This allows a user to accidentally create a task with sensitive input data that will then be stored unencrypted in a database.

Recommendations For versions prior to 4.2.0, ensure that the encryption setting is correctly set when creating tasks in encrypted collaborations to prevent sensitive input data from being stored unencrypted in the database. As a temporary workaround, consider double-checking the encryption settings for each task created in an encrypted collaboration until a patch is applied.

Exploit

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2024-22193

GHSA-RJMV-52MP-GJRR

PYSEC-2024-32

Affected Products

Vantage6

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22193.json · Exploit
• https://github.com/vantage6/vantage6/commit/6383283733b81abfcacfec7538dc4dc882e98074 · Patch
• https://github.com/vantage6/vantage6/security/advisories/GHSA-rjmv-52mp-gjrr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22193 · Security Note
• https://osv.dev/vulnerability/GHSA-rjmv-52mp-gjrr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-32 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2024-32.yaml · Note
• https://github.com/vantage6/vantage6 · Note
• https://twitter.com/CVEnew/status/1752359081279418562 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1752384766421127308 · Twitter Post