CVE-2021-39182

Insecure MD5 hashing in EnroCrypt < v1.1.4

• CVSS 7.5
• CWE-326 Inadequate Encryption Strength
• Cryptographic
• Local

EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`.

CVE

CVE-2021-39182

CWE

CWE-326 Inadequate Encryption Strength

CVSS base score

7.5

Published

2021-11-08

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Cryptographic

Subcategory

Weak encryption algorithm

Accessibility scope

Local

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update EnroCrypt to version 1.1.4 or higher.

import hashlib

def hash(data):
    return hashlib.md5(data.encode()).hexdigest()

if __name__ == "__main__":
    data_to_hash = "example_data"
    print("Hash:", hash(data_to_hash))

import hashlib

def hash(data):
    # SECURE: This version prevents crypto weakness
    return hashlib.sha256(data.encode()).hexdigest()

if __name__ == "__main__":
    data_to_hash = "example_data"
    print("Hash:", hash(data_to_hash))

@misc{vaitp:cve202139182,
  title        = {{Insecure MD5 hashing in EnroCrypt < v1.1.4}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-39182},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-39182/}}
}