CVE-2021-39182 Improper hashing in enrocrypt
EnroCrypt uses the insecure MD5 algorithm for hashing, allowing attackers to potentially reverse hashes or bypass security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39182?
CVE-2021-39182 is a high-severity vulnerability in Morgan-Phoenix EnroCrypt, published on 8 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`.
Which versions are affected by CVE-2021-39182?
3 open source packages ship an affected version, including enrocrypt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
enrocrypt PyPI | All versions | 1.1.4 |
enrocrypt PyPI | All versions | 1.1.4 |
enrocrypt PyPI | All versions | 1.1.4 |
Products include Enrocrypt Project Enrocrypt.
How do I fix CVE-2021-39182?
Upgrade enrocrypt to 1.1.4 or later.
Is CVE-2021-39182 being exploited?
There is no known exploitation of CVE-2021-39182 in the wild and no public exploit code.
Sources
Also known as GHSA-35m5-8cvj-8783, PYSEC-2021-385.