Is CVE-2022-39228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39228 being exploited in the wild.

How severe is CVE-2022-39228?

Medium severity, with a CVSS score of 6.5, published 28 February 2023.

Which products and versions are affected?

vantage6 (PyPI) < 3.8.0, ECOSYSTEM:introduced=0,fixed=3.8.0, ECOSYSTEM:introduced=3.3.3,fixed=3.8.0, GIT:introduced=0,fixed=ab4381c35d24add06f75d5a8a284321f7a340bd2|ECOSYSTEM:introduced=3.3.3,fixed=3.8.0.

Is there a fix for CVE-2022-39228?

Yes. vantage6 (PyPI): upgrade to 3.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39228 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-39228?

Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39228: vantage6 username enumeration via account lockout discrepancy

Q: Which products and versions are affected?

vantage6 (PyPI) < 3.8.0, ECOSYSTEM:introduced=0,fixed=3.8.0, ECOSYSTEM:introduced=3.3.3,fixed=3.8.0, GIT:introduced=0,fixed=ab4381c35d24add06f75d5a8a284321f7a340bd2|ECOSYSTEM:introduced=3.3.3,fixed=3.8.0.

Q: Is there a fix for CVE-2022-39228?

Yes. vantage6 (PyPI): upgrade to 3.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2022-39228 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2022-39228?

Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39228 · Severity: medium · CVSS 6.5 · Published 2023-02-28

vantage6 is an open-source framework for privacy-preserving federated learning. A vulnerability in its login system allows unauthorized users to determine if a specific username exists on the platform. By repeatedly attempting to log in with a potential username, an attacker can observe if the account becomes temporarily blocked, confirming the username's validity and potentially facilitating targeted credential-stuffing attacks.

Technologies: vantage6 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-39228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39228 being exploited in the wild.
How severe is CVE-2022-39228?: Medium severity, with a CVSS score of 6.5, published 28 February 2023.
Which products and versions are affected?: vantage6 (PyPI) < 3.8.0, ECOSYSTEM:introduced=0,fixed=3.8.0, ECOSYSTEM:introduced=3.3.3,fixed=3.8.0, GIT:introduced=0,fixed=ab4381c35d24add06f75d5a8a284321f7a340bd2|ECOSYSTEM:introduced=3.3.3,fixed=3.8.0.
Is there a fix for CVE-2022-39228?: Yes. vantage6 (PyPI): upgrade to 3.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39228 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-39228?: Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vantage6 (PyPI): upgrade to 3.8.0 or later
```
pip install "vantage6>=3.8.0"
```

Technical details

The vulnerability is classified as an Observable Response Discrepancy (CWE-204). While the application correctly returns generic error messages for failed login attempts to prevent simple enumeration, it implements a temporary account lockout policy after a specific number of failed attempts. An attacker can exploit this by submitting multiple failed login requests for a target username; if the account exists, it will eventually be blocked, creating a detectable change in system behavior or response timing compared to non-existent accounts. This allows for automated username harvesting via the network without prior authentication. The issue is resolved in version 3.8.0.

Affected products

vantage6 vantage6 < 3.8.0

Identifiers

CVE-2022-39228
GHSA-36gx-9q6h-g429
PYSEC-2023-313
PYSEC-2023-52

Timeline

2022-09-13: disclosed: CVE-2022-39228 assigned
2023-02-28: patched: Fix merged in version 3.8.0
2023-02-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.