CVE-2021-39182

描述

EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`.

如何修補 CVE-2021-39182

要修補 CVE-2021-39182,請將受影響套件升級到下列已修補版本。

• —升級至 1.1.4 或更新版本
• —升級至 e652d56ac60eadfc26489ab83927af13a9b9d8ce 或更新版本

CVE-2021-39182 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 1.1.4
• from 0, < e652d56ac60eadfc26489ab83927af13a9b9d8ce | from 0, < 1.1.4

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-39182
• PATCHgithub.com/Morgan-Phoenix/EnroCrypt
• WEBgithub.com/Morgan-Phoenix/EnroCrypt/commit/e652d56ac60eadfc26489ab83927af13a9b9d8ce
• WEBgithub.com/Morgan-Phoenix/EnroCrypt/security/advisories/GHSA-35m5-8cvj-8783