PT-2024-29029 · Apache · Apache Answer

Sam Bull · Published 2024-09-25 · Updated 2025-07-10 · CVE-2024-40761

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.3.5

Description The issue is related to inadequate encryption strength, where the MD5 value of a user's email is used to access Gravatar, leading to potential leakage of user email. The official recommendation is to use SHA256 instead.

Recommendations Upgrade to version 1.4.0, which fixes the issue. As a temporary workaround, consider using SHA256 instead of MD5 for accessing Gravatar to minimize the risk of exploitation.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2024-40761

GHSA-48CR-J2CX-MCR8

GO-2024-3158

Affected Products

Apache Answer

References · 25

• https://osv.dev/vulnerability/GHSA-48cr-j2cx-mcr8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-40761 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40761 · Security Note
• https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08x · Vendor Advisory
• https://github.com/apache/incubator-answer · Note
• https://github.com/apache/incubator-answer/commit/c3a17046c6c3be1cec16ba49d07d9f7742b7260f · Note
• http://openwall.com/lists/oss-security/2024/09/27/5 · Note
• https://github.com/advisories/GHSA-48cr-j2cx-mcr8 · Note
• http://openwall.com/lists/oss-security/2024/09/25/6 · Note
• https://t.me/cvenotify/95912 · Telegram Post
• http://openwall.com/lists/oss-security/2024/09/26/4 · Note
• https://t.me/cvedetector/6300 · Telegram Post
• https://twitter.com/CVEnew/status/1838845930033889471 · Twitter Post
• http://openwall.com/lists/oss-security/2024/09/26/1 · Note