Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-39182

CVE-2021-39182: Improper hashing in enrocrypt

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-39182
GHSA ID
GHSA-35m5-8cvj-8783
EPSS Score
0.24376%
CWE
CWE-326
Published
11/10/2021
Updated
9/20/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
enrocryptpip< 1.1.41.1.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability explicitly references hashing.py as the root cause. The commit diff shows removal of the MD5() method from hashing.py, confirming it was the vulnerable component. MD5 is well-known to be insecure for cryptographic purposes (CWE-327/328/916), and the advisory directly links removal of this function to resolving the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** vuln*r**ility is w* us** M** **s*in* *l*orit*m In our **s*in* *il*. I* *nyon* w*o is * ***inn*r(*n* *o*sn't know **out **s**s) **n **** pro*l*ms *s M** is *onsi**r** * Ins**ur* **s*in* *l*orit*m. ### P*t***s T** vuln*r**ility is p*t

Reasoning

T** vuln*r**ility *xpli*itly r***r*n**s `**s*in*.py` *s t** root **us*. T** *ommit *i** s*ows r*mov*l o* t** `M**()` m*t*o* *rom `**s*in*.py`, *on*irmin* it w*s t** vuln*r**l* *ompon*nt. `M**` is w*ll-known to ** ins**ur* *or *rypto*r*p*i* purpos*s (