What is CVE-2024-21670?

CVE-2024-21670 is a medium-severity vulnerability in Hyperledger Ursa, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 6.5/10. Published 2024-01-16.

How severe is CVE-2024-21670?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Hyperledger Ursa

CVE-2024-21670

Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that credential as part of an AnonCreds presentation. A verifier may verify a credential from a holder as being "not revoked" when in fact, the holder's credential has been revoked. Ursa has moved to end-of-life status and no fix is expected.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.003 (19.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N.

Affected products

Hyperledger Ursa — versions 0.1.0
Hyperledger-archives Ursa — versions <= 0.3.7

Weakness classification (CWE)

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2024-21670?: CVE-2024-21670 is a medium-severity vulnerability in Hyperledger Ursa, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 6.5/10. Published 2024-01-16.
How severe is CVE-2024-21670?: Medium severity. CVSS v3 base score is 6.5 out of 10.