Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00OGNyLWoyY3gtbWNyOM4AA_xB

Apache Answer: Avatar URL leaked user email addresses

Inadequate Encryption Strength vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Permalink: https://github.com/advisories/GHSA-48cr-j2cx-mcr8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00OGNyLWoyY3gtbWNyOM4AA_xB
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 27 days ago
Updated: 27 days ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-48cr-j2cx-mcr8, CVE-2024-40761
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-40761
• https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08x
• https://github.com/apache/incubator-answer/commit/c3a17046c6c3be1cec16ba49d07d9f7742b7260f
• https://github.com/advisories/GHSA-48cr-j2cx-mcr8

Repository: https://github.com/apache/incubator-answer
Blast Radius: 1.0

Affected Packages