Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

enrocrypt

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PyPIAmendedPublished

    Improper hashing in enrocrypt

    CVE-2021-39182 · GHSA-35m5-8cvj-8783

    Affected
    • PyPI enrocrypt < 1.1.4
    Fixed in
    1.1.4· Vendor fix available
    Issue
    Impact The vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginner(and doesn't know about hashes) can face problems as MD5 is considered a Insecure Hashing Algorithm. Patches The vulnerability is patched in v1.1.4 of the product, the users can upgrade to version 1.1.4. Workarounds If u specifically want a version and don't want to upgrade, you can remove the MD5 hashing function from the file hashing.py and this vulnerability will be gone References https://www.cybersecurity-help.cz/vdb/cwe/916/ https://www.cybersecurity-help.cz/vdb/cwe/327/ https://www.cybersecurity-help.cz/vdb/cwe/328/ https://www.section.io/engineering-education/what-is-md5/ https://www.johndcook.com/blog/2019/01/24/reversing-an-md5-hash/ For more information If you have any questions or comments about this advisory: Open an issue in Enrocrypt's Official Repo Create a Discussion in Enrocrypt's Official Repo

    Recommended action: Upgrade to 1.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →