CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-21670
High (8.1) in hyperledger ursa. EPSS 0.3% chance of exploitation in the next 30 days.
Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that credential as part of an AnonCreds presentation. A verifier may verify a credential from a holder as being "not revoked" when in fact, the holder's credential has been revoked. Ursa has moved to end-of-life status and no fix is expected.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
- CWE
- CWE-327
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hyperledger:ursa
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r78f-4q2q-hvv4 | crates.io | ursa | <=0.3.7 | no fix published |
| GHSA-r78f-4q2q-hvv4 | crates.io | anoncreds-clsignatures | all versions | no fix published |