Critical, CVSS 9.9PyPIAmendedPublished
Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
CVE-2024-21669 · GHSA-97x9-59rv-q5pm
- Affected
- PyPI aries-cloudagent >= 0.7.0, < 0.10.5; >= 0.11.0rc1, < 0.11.0
- Fixed in
- 0.10.50.11.0· Vendor fix available
- Issue
- Impact When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. Below is an example result from verifying a JSON-LD Presentation where there is an error noted in the processing (mismatched challenge), but the overall result is incorrectly `"verified": true`: ```json { "verified": true, "presentation_result": { "verified": false, "document": { "@context": [ "https://www.w3.org/2018/credentials/v1" ], "type": [ "VerifiablePresentation" ], "verifiableCredential": [ { "@context": [ "https://www.w3.org/2018/credentials/v1", "https://w3id.org/citizenship/v1" ], "type": [ "VerifiableCredential", "PermanentResident" ], "issuer": "did:sov:EzcfrVw7Tveho5NjrmDWnd", "issuanceDate": "2023-11-18", "credentialSubject": { "type": [ "PermanentResident" ], "id":…
Recommended action: Upgrade to 0.11.0 or 0.10.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.