{"answers":{"affected":"3 open source packages ship an affected version, including enrocrypt. It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-39182 in the wild and no public exploit code.","fix":"Upgrade enrocrypt to 1.1.4 or later.","what":"CVE-2021-39182 is a high-severity vulnerability in Morgan-Phoenix EnroCrypt, published on 8 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-39182 and fix it if it is affected.\n\nWhat it is: CVE-2021-39182 is a high-severity vulnerability in Morgan-Phoenix EnroCrypt, published on 8 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-39182 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- enrocrypt (PyPI): affected all versions; fixed in 1.1.4\n- enrocrypt (PyPI): affected all versions; fixed in 1.1.4\n- enrocrypt (PyPI): affected all versions; fixed in 1.1.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-39182/ (Markdown: https://insights.sbomify.com/CVE-2021-39182/index.md)","id":"CVE-2021-39182","markdown":"https://insights.sbomify.com/CVE-2021-39182/index.md","name":"CVE-2021-39182","record":{"aliases":["GHSA-35m5-8cvj-8783","PYSEC-2021-385"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Python encryption library","requires_auth":"none","summary":"EnroCrypt uses the insecure MD5 algorithm for hashing, allowing attackers to potentially reverse hashes or bypass security checks.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"enrocrypt","vendor":"enrocrypt_project"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-326","name":"Inadequate Encryption Strength"},{"id":"CWE-916","name":"Use of Password Hash With Insufficient Computational Effort"},{"id":"CWE-328","name":"Use of Weak Hash"},{"id":"CWE-327","name":"Use of a Broken or Risky Cryptographic Algorithm"}],"description":"EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Improper hashing in enrocrypt","id":"CVE-2021-39182","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"weak_cryptography","year":"2021"},"n_packages":3,"n_references":2,"next":{"headline":"Unsafe inline XSS Owncast","id":"CVE-2021-39183"},"packages":[{"ecosystem":"PyPI","fixed":["1.1.4"],"introduced":["0"],"last_affected":[],"package":"enrocrypt","purl":null,"source":"GHSA-35m5-8cvj-8783"},{"ecosystem":"PyPI","fixed":["1.1.4"],"introduced":["0"],"last_affected":[],"package":"enrocrypt","purl":"pkg:pypi/enrocrypt","source":"GHSA-35m5-8cvj-8783"},{"ecosystem":"PyPI","fixed":["1.1.4"],"introduced":["0"],"last_affected":[],"package":"enrocrypt","purl":"pkg:pypi/enrocrypt","source":"PYSEC-2021-385"}],"prev":{"headline":"Unsafe Deserialization of User Data Using XStream","id":"CVE-2021-39181"},"products":["EnroCrypt"],"published":"2021-11-08","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["Morgan-Phoenix"]},"summary":"EnroCrypt uses the insecure MD5 algorithm for hashing, allowing attackers to potentially reverse hashes or bypass security checks.","url":"https://insights.sbomify.com/CVE-2021-39182/"}