
oss-sec mailing list archives
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses
From: Alexander Patrakov <patrakov () gmail com>
Date: Fri, 27 Sep 2024 20:25:54 +0800
On Thu, Sep 26, 2024 at 5:19 AM Demi Marie Obenour <demi () invisiblethingslab com> wrote:
On Wed, Sep 25, 2024 at 06:28:16AM +0000, Enxin Xie wrote:Severity: low Affected versions: - Apache Answer through 1.3.5 Description: Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommended to upgrade to version 1.4.0, which fixes the issue. Credit: 张岳熙 (reporter) References: https://answer.incubator.apache.org https://www.cve.org/CVERecord?id=CVE-2024-40761What is the specific property of SHA256 required here? Email addresses have low entropy and I suspect they can be easily brute-forced, so leaking the SHA256 has is still bad. Instead, I would use a seeded PRF with a seed only known to the server, ensuring that the resulting value does not leak any information about the email. -- Sincerely, Demi Marie Obenour (she/her/hers) Invisible Things Lab
I don't think that a seeded PRF (with a per-server seed) would meet the requirements here. The problem is that Gravatar would have no way of understanding which email is in question. Indeed, that would require storing all emails hashed with all registered server seeds. What would work is an email hash encrypted symmetrically with a per-server key. Then Gravatar (who also knows this key) would decrypt the email hash and look up the avatar image. Note that all of the above talks about a hypothetical improved version of Gravatar, not what we have right now. -- Alexander Patrakov
Current thread:
- CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Enxin Xie (Sep 25)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Solar Designer (Sep 25)
- RE: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Goldberg, Adam (Sep 25)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Jeffrey Walton (Sep 25)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses LinkinStar (Sep 26)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Solar Designer (Sep 26)
- RE: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Goldberg, Adam (Sep 25)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Demi Marie Obenour (Sep 25)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Alexander Patrakov (Sep 27)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Fabian Bäumer (Sep 27)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Sam Bull (Sep 27)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Alexander Patrakov (Sep 27)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Solar Designer (Sep 25)
- Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses Fabian Bäumer (Sep 26)