CVE-2024-21670 — MEDIUM (6.5)

Vulnerability Description

Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that credential as part of an AnonCreds presentation. A verifier may verify a credential from a holder as being "not revoked" when in fact, the holder's credential has been revoked. Ursa has moved to end-of-life status and no fix is expected.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Hyperledger	Ursa	0.1.0

Related Weaknesses (CWE)

CWE-327

References

https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-r78f-4q2q-Vendor Advisory
https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-r78f-4q2q-Vendor Advisory

FAQ

What is CVE-2024-21670?

CVE-2024-21670 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by th...

How severe is CVE-2024-21670?

CVE-2024-21670 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-21670?

Check the references section above for vendor advisories and patch information. Affected products include: Hyperledger Ursa.