PT-2024-19011 · Hyperledger · Hyperledger Aries Cloud Agent Python

Dbluhm · Published 2024-01-09 · Updated 2024-01-20 · CVE-2024-21669

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Hyperledger Aries Cloud Agent Python (ACA-Py) versions 0.7.0 through 0.10.4

Description The issue arises when verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs). The result of verifying the presentation document.proof was not factored into the final verified value on the presentation record. This flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. All ACA-Py users depending on W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs are impacted by this vulnerability.

Recommendations For Hyperledger Aries Cloud Agent Python (ACA-Py) versions 0.7.0 through 0.10.4, update to version 0.10.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs until a patched version is available.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2024-21669

GHSA-97X9-59RV-Q5PM

Affected Products

Hyperledger Aries Cloud Agent Python

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21669.json · Exploit
• 🔥 https://github.com/hyperledger/aries-cloudagent-python/security/advisories/GHSA-97x9-59rv-q5pm · Exploit
• https://github.com/hyperledger/aries-cloudagent-python/commit/4c45244e2085aeff2f038dd771710e92d7682ff2 · Patch
• https://github.com/hyperledger/aries-cloudagent-python/commit/0b01ffffc0789205ac990292f97238614c9fd293 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-21669 · Security Note
• https://osv.dev/vulnerability/GHSA-97x9-59rv-q5pm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21669 · Vendor Advisory
• https://github.com/hyperledger/aries-cloudagent-python · Note
• https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.11.0 · Note
• https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.10.5 · Note
• https://twitter.com/CVEnew/status/1745322781758165134 · Twitter Post
• https://t.me/cvenotify/68127 · Telegram Post
• https://t.me/cvenotify/67006 · Telegram Post