{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22192", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-08T04:59:27.370Z", "datePublished": "2024-01-16T21:44:53.121Z", "dateUpdated": "2024-08-01T22:35:34.928Z"}, "containers": {"cna": {"title": "Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders", "problemTypes": [{"descriptions": [{"cweId": "CWE-327", "lang": "en", "description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g"}], "affected": [{"vendor": "hyperledger-archives", "product": "ursa", "versions": [{"version": "<= 0.3.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-16T21:44:53.121Z"}, "descriptions": [{"lang": "en", "value": "Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. Notably, a malicious verifier may be able to generate a unique identifier for a holder providing a verifiable presentation that includes a Non-Revocation proof. The impact of the flaw is that a malicious verifier may be able to determine a unique identifier for a holder presenting a Non-Revocation proof. Ursa has moved to end-of-life status and no fix is expected."}], "source": {"advisory": "GHSA-6698-mhxx-r84g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.928Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hyperledger:ursa:0.1.0:*:*:*:*:rust:*:*", "matchCriteriaId": "8997F554-6E18-4F21-B042-4954CD22436D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. Notably, a malicious verifier may be able to generate a unique identifier for a holder providing a verifiable presentation that includes a Non-Revocation proof. The impact of the flaw is that a malicious verifier may be able to determine a unique identifier for a holder presenting a Non-Revocation proof. Ursa has moved to end-of-life status and no fix is expected."}, {"lang": "es", "value": "Ursa es una librer\u00eda criptogr\u00e1fica para usar con blockchains. El esquema de revocaci\u00f3n que forma parte de las implementaciones de Ursa CL-Signatures tiene un fallo que podr\u00eda afectar las garant\u00edas de privacidad definidas por el modelo de credenciales verificables de AnonCreds. En particular, un verificador malicioso puede generar un identificador \u00fanico para un titular que proporcione una presentaci\u00f3n verificable que incluya una prueba de no revocaci\u00f3n. El impacto del fallo es que un verificador malicioso puede determinar un identificador \u00fanico para un titular que presenta una prueba de no revocaci\u00f3n. Ursa ha pasado al estado de fin de vida \u00fatil y no se espera ninguna soluci\u00f3n."}], "id": "CVE-2024-22192", "lastModified": "2024-11-21T08:55:45.943", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-16T22:15:46.220", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}