CVE-2024-21653CWE-284

vantage6 insecure SSH configuration for node and server containers

Medium · published January 30, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. The vulnerability can be mitigated by removing the ssh part from the docker file and rebuilding the docker image. Version 4.2.0 patches the vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-01-30T15:39Z
EPSS history
Timeline
  • 30 JAN 15:39Z
    vantage6 insecure SSH configuration for node and server containers
    cvelistv5