CVE-2021-39182

Katalog CVE

CVSS 7.5 · High EPSS 0,56%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada enrocrypt project enrocrypt. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`.

Rincian

Terbit di NVD

8 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-328: Use of Weak Hash
CWE-916: Use of Password Hash With Insufficient Computational Effort
CWE-326: Inadequate Encryption Strength

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Morgan-Phoenix/EnroCrypt/commit/e652d56ac60eadfc26489ab83927af13a9b9d8ce exploit · advisory pihak ketiga
• https://github.com/Morgan-Phoenix/EnroCrypt/security/advisories/GHSA-35m5-8cvj-8783 advisory pihak ketiga