GHSA-48cr-j2cx-mcr8

Source

https://github.com/advisories/GHSA-48cr-j2cx-mcr8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-48cr-j2cx-mcr8/GHSA-48cr-j2cx-mcr8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-48cr-j2cx-mcr8

Aliases

CVE-2024-40761
GO-2024-3158

Published

2024-09-25T09:30:46Z

Modified

2024-09-26T18:57:32.172784Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green CVSS Calculator

Summary

Apache Answer: Avatar URL leaked user email addresses

Details

Inadequate Encryption Strength vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Database specific

{
    "nvd_published_at": "2024-09-25T08:15:04Z",
    "cwe_ids": [
        "CWE-326"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-25T14:31:51Z"
}

References

Affected packages

Go / github.com/apache/incubator-answer

Package

Name: github.com/apache/incubator-answer; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/incubator-answer

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.0