oss-sec mailing list archives

CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses

From: Enxin Xie <linkinstar () apache org>
Date: Wed, 25 Sep 2024 06:28:16 +0000

Severity: low

Affected versions:

- Apache Answer through 1.3.5

Description:

Inadequate Encryption Strength vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The 
official recommendation is to use SHA256 instead.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Credit:

张岳熙 (reporter)

References:

https://answer.incubator.apache.org
https://www.cve.org/CVERecord?id=CVE-2024-40761

Current thread:

CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Enxin Xie (Sep 25)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Solar Designer (Sep 25)
  - RE: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Goldberg, Adam (Sep 25)
    - Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Jeffrey Walton (Sep 25)
  - Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses LinkinStar (Sep 26)
    - Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Solar Designer (Sep 26)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Demi Marie Obenour (Sep 25)
  - Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Alexander Patrakov (Sep 27)
    - Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Fabian Bäumer (Sep 27)
    - Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Sam Bull (Sep 27)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Fabian Bäumer (Sep 26)