Description
vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is fixed in 4.11.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vantage6 | vantage6 | < 4.11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | vantage6-server | < 4.11.0 | 4.11.0 | GHSA-m3mq-f375-5vgh |