GMS-2023-492: vantage6 refresh tokens do not expire

March 4, 2023 (updated November 7, 2023)

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.

References

github.com/advisories/GHSA-4w59-c3gc-rrhp
github.com/vantage6/vantage6/commit/48ebfca42359e9a6743e9598684585e2522cdce8
github.com/vantage6/vantage6/security/advisories/GHSA-4w59-c3gc-rrhp
nvd.nist.gov/vuln/detail/CVE-2023-23929

Code Behaviors & Features

Detect and mitigate GMS-2023-492 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →