PT-2021-23641 · Max Mazurov · Maddy

Published 2021-12-28 · Updated 2024-08-21 · CVE-2021-42583

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Max Mazurov Maddy versions prior to 0.5.2

Description The issue concerns the use of a broken or risky cryptographic algorithm, which poses an unnecessary risk that may result in the exposure of sensitive information.

Recommendations For versions prior to 0.5.2, update to version 0.5.2 or later to resolve the issue.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2021-42583

GHSA-5R5W-H76P-M726

GO-2022-0306

Affected Products

Maddy

References · 8

• https://osv.dev/vulnerability/GHSA-5r5w-h76p-m726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42583 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42583 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0306 · Vendor Advisory
• https://github.com/foxcpp/maddy · Note
• https://github.com/foxcpp/maddy/blob/df40dce1284cd0fd0a9e8e7894029553d653d0a5/internal/auth/shadow/verify.go · Note
• https://github.com/foxcpp/maddy/releases/tag/v0.5.2 · Note
• https://github.com/advisories/GHSA-5r5w-h76p-m726 · Note