PT-2021-22440 · Enrocrypt · Enrocrypt

Published 2021-11-08 · Updated 2023-07-17 · CVE-2021-39182

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions EnroCrypt versions prior to 1.1.4

Description EnroCrypt is a Python module for encryption and hashing that used the MD5 hashing algorithm in the hashing file, which is considered an insecure hashing algorithm. This can cause problems for beginners who are unfamiliar with hashes. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions prior to 1.1.4, upgrade to version 1.1.4 to patch the vulnerability. As a temporary workaround for versions prior to 1.1.4, users can remove the MD5 hashing function from the file hashing.py to mitigate the issue.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Inadequate Encryption Strength

Weakness Enumeration

CWE-328

CWE-327

CWE-326

CWE-916

Related Identifiers

CVE-2021-39182

GHSA-35M5-8CVJ-8783

PYSEC-2021-385

Affected Products

Enrocrypt

References · 11

• 🔥 https://github.com/Morgan-Phoenix/EnroCrypt/commit/e652d56ac60eadfc26489ab83927af13a9b9d8ce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-39182 · Security Note
• https://osv.dev/vulnerability/GHSA-35m5-8cvj-8783 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39182 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-385 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/enrocrypt/PYSEC-2021-385.yaml · Note
• https://github.com/Morgan-Phoenix/EnroCrypt/security/advisories/GHSA-35m5-8cvj-8783 · Note
• https://github.com/Morgan-Phoenix/EnroCrypt · Note
• https://t.me/cibsecurity/31985 · Telegram Post
• https://t.me/cvenotify/23131 · Telegram Post
• https://t.me/cvenotify/54484 · Telegram Post