GitHub Advisoryadvisory · PyPI
GHSA-4w59-c3gc-rrhp vantage6 refresh tokens do not expire
HIGH
Official page ↗
- Aliases
- CVE-2023-23929
- Ecosystem
- PyPI
- Packages
- vantage6
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-613
- Reviewed
- 2023-02-28
Affected packages
• PyPI vantage6: < 3.8.0 → fixed in 3.8.0
Description
From issue:
Problem description
Currently, the refresh token is valid indefinitely. This is bad security practice.
Desired solution
The refresh token should get a validity of 24-48 hours.
Additional context
When implementing this, also check that the refresh token returns a new refresh token
When implementing this, also adapt the UI so that it logs out if refresh token is no longer valid.
When implementing this, ensure that nodes refresh their token periodically so that they do not have to be restarted manually.
Impact
Patches
None available
Workarounds
None available
Related
Weakness · not in database (1)
Alias · CVE (1)
- CVE-2023-23929 vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vulnerability
References
- https://github.com/vantage6/vantage6/security/advisories/GHSA-4w59-c3gc-rrhp web
- https://nvd.nist.gov/vuln/detail/CVE-2023-23929 advisory
- https://github.com/vantage6/vantage6/commit/48ebfca42359e9a6743e9598684585e2522cdce8 web
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-54.yaml web
- https://github.com/vantage6/vantage6 package