CVE-2024-40761
Severity CVSS v4.0:
Pending analysis
Type:
CWE-326
Inadequate Encryption Strength
Publication date:
25/09/2024
Last modified:
10/07/2025
Description
Inadequate Encryption Strength vulnerability in Apache Answer.<br />
<br />
This issue affects Apache Answer: through 1.3.5.<br />
<br />
Using the MD5 value of a user&#39;s email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead.<br />
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:* | 1.3.5 (including) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08x
- http://www.openwall.com/lists/oss-security/2024/09/25/2
- http://www.openwall.com/lists/oss-security/2024/09/25/5
- http://www.openwall.com/lists/oss-security/2024/09/25/6
- http://www.openwall.com/lists/oss-security/2024/09/25/7
- http://www.openwall.com/lists/oss-security/2024/09/25/8
- http://www.openwall.com/lists/oss-security/2024/09/26/1
- http://www.openwall.com/lists/oss-security/2024/09/26/3
- http://www.openwall.com/lists/oss-security/2024/09/26/4
- http://www.openwall.com/lists/oss-security/2024/09/27/4
- http://www.openwall.com/lists/oss-security/2024/09/27/5
- http://www.openwall.com/lists/oss-security/2024/09/27/8