CVE-2023-23929
Refresh tokens do not expire in Vantage6
Résumé
Refresh tokens do not expire in Vantage6
Description d'origine
La description telle que publiée par la source (souvent en anglais).
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
PyPI
vantage6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com