CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22192 – Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders
https://notcve.org/view.php?id=CVE-2024-22192
Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. Notably, a malicious verifier may be able to generate a unique identifier for a holder providing a verifiable presentation that includes a Non-Revocation proof. The impact of the flaw is that a malicious verifier may be able to determine a unique identifier for a holder presenting a Non-Revocation proof. Ursa has moved to end-of-life status and no fix is expected. • https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21670 – CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential
https://notcve.org/view.php?id=CVE-2024-21670
Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that credential as part of an AnonCreds presentation. A verifier may verify a credential from a holder as being "not revoked" when in fact, the holder's credential has been revoked. Ursa has moved to end-of-life status and no fix is expected. Ursa es una librería criptográfica para usar con blockchains. • https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-r78f-4q2q-hvv4 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31021 – Unlinkability broken in ursa when verifiers use malicious keys
https://notcve.org/view.php?id=CVE-2022-31021
Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in the Ursa and AnonCreds implementations is that the Issuer does not publish a key correctness proof demonstrating that a generated private key is sufficient to meet the unlinkability guarantees of AnonCreds. The Ursa and AnonCreds CL-Signatures implementations always generate a sufficient private key. A malicious issuer could in theory create a custom CL Signature implementation (derived from the Ursa or AnonCreds CL-Signatures implementations) that uses weakened private keys such that presentations from holders could be shared by verifiers to the issuer who could determine the holder to which the credential was issued. This vulnerability could impact holders of AnonCreds credentials implemented using the CL-signature scheme in the Ursa and AnonCreds implementations of CL Signatures. • https://github.com/hyperledger/ursa/security/advisories/GHSA-2q6j-gqc4-4gw3 https://www.brics.dk/RS/98/29/BRICS-RS-98-29.pdf • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 1CVE-2024-21669 – Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
https://notcve.org/view.php?id=CVE-2024-21669
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5. Hyperledger Aries Cloud Agent Python (ACA-Py) es una base para crear aplicaciones y servicios de identidad descentralizados que se ejecutan en entornos no móviles. • https://github.com/hyperledger/aries-cloudagent-python/commit/0b01ffffc0789205ac990292f97238614c9fd293 https://github.com/hyperledger/aries-cloudagent-python/commit/4c45244e2085aeff2f038dd771710e92d7682ff2 https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.10.5 https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.11.0 https://github.com/hyperledger/aries-cloudagent-python/security/advisories/GHSA-97x9-59rv-q5pm • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 1CVE-2023-46132 – Crosslinking transaction attack in hyperledger/fabric
https://notcve.org/view.php?id=CVE-2023-46132
Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. • https://github.com/hyperledger/fabric/security/advisories/GHSA-v9w2-543f-h69m • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •