CVE-2024-21670
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-21670
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21670.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-21670
- Aliases
- Published
- 2024-01-16T22:15:45Z
- Modified
- 2024-05-14T13:08:51.475006Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that credential as part of an AnonCreds presentation. A verifier may verify a credential from a holder as being "not revoked" when in fact, the holder's credential has been revoked. Ursa has moved to end-of-life status and no fix is expected.
- References