Vulnerability Description
Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Answer | <= 1.3.5 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08xMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2024/09/25/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/25/5Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/25/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/25/7Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/25/8Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/26/1Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/26/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/26/4Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/27/4Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/27/5Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/27/8Mailing ListThird Party Advisory
FAQ
What is CVE-2024-40761?
CVE-2024-40761 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to t...
How severe is CVE-2024-40761?
CVE-2024-40761 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-40761?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Answer.