PT-2024-31737 · Apache · Apache Answer

Chi Tran · Published 2024-11-22 · Updated 2025-07-01 · CVE-2024-45719

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Answer versions through 1.4.0

Description: The issue is related to inadequate encryption strength in Apache Answer, specifically with the use of UUID v1 version for generating ids. This can cause the generated token to be predictable, potentially leading to sensitive data exposure.

Recommendations: For Apache Answer versions through 1.4.0, upgrade to version 1.4.1 to fix the issue. As a temporary workaround, consider restricting the use of UUID v1 version for generating ids until the upgrade is applied.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2024-45719

GHSA-MR95-VFCF-FX9P

GO-2024-3287

OPENSUSE-SU-2024:14567-1

Affected Products

Apache Answer

References · 36

• https://osv.dev/vulnerability/CVE-2024-45719 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mr95-vfcf-fx9p · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14567-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3287 · Vendor Advisory
• https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45719 · Security Note
• https://github.com/apache/incubator-answer · Note
• https://suse.com/security/cve/CVE-2024-53264 · Note
• https://suse.com/security/cve/CVE-2024-53858 · Note
• https://t.me/cvenotify/127317 · Telegram Post
• https://twitter.com/CVEnew/status/1859973003574128784 · Twitter Post
• https://github.com/advisories/GHSA-mr95-vfcf-fx9p · Note
• https://twitter.com/oktsec/status/1860014904792485931 · Twitter Post
• https://suse.com/security/cve/CVE-2024-54132 · Note
• https://suse.com/security/cve/CVE-2024-50948 · Note