GitHub Advisoryadvisory · PyPI

GHSA-35m5-8cvj-8783 Improper hashing in enrocrypt

HIGH Published 2021-11-10 Modified 2024-09-20 Official page ↗
Aliases
CVE-2021-39182
Ecosystem
PyPI
Packages
enrocrypt
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-326, CWE-327, CWE-328, CWE-916
Reviewed
2021-11-08

Affected packages

• PyPI enrocrypt: < 1.1.4 → fixed in 1.1.4

Description

Impact The vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginner(and doesn't know about hashes) can face problems as MD5 is considered a Insecure Hashing Algorithm. Patches The vulnerability is patched in v1.1.4 of the product, the users can upgrade to version 1.1.4. Workarounds If u specifically want a version and don't want to upgrade, you can remove the `MD5` hashing function from the file `hashing.py` and this vulnerability will be gone References https://www.cybersecurity-help.cz/vdb/cwe/916/ https://www.cybersecurity-help.cz/vdb/cwe/327/ https://www.cybersecurity-help.cz/vdb/cwe/328/ https://www.section.io/engineering-education/what-is-md5/ https://www.johndcook.com/blog/2019/01/24/reversing-an-md5-hash/ For more information If you have any questions or comments about this advisory: • Open an issue in Enrocrypt's Official Repo • Create a Discussion in Enrocrypt's Official Repo

Related

Alias · CVE (1)

  • CVE-2021-39182 EnroCrypt is a Python module for encryption and hashing. vulnerability

Weakness · CWE (4)

  • CWE-326 Inadequate Encryption Strength weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
  • CWE-328 Use of Weak Hash weakness
  • CWE-916 Use of Password Hash With Insufficient Computational Effort weakness

References