Vulnerability in enrocrypt (CVE-2021-39182)
Summary
Vulnerability in enrocrypt (CVE-2021-39182). Confidential information can be exposed externally. Exploitable via MD5. Mitigation: upgrade to 1.1.4 or later.
Original description
The description as published by the source.
Impact
The vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginner(and doesn't know about hashes) can face problems as MD5 is considered a Insecure Hashing Algorithm.
Patches
The vulnerability is patched in v1.1.4 of the product, the users can upgrade to version 1.1.4.
Workarounds
If u specifically want a version and don't want to upgrade, you can remove the MD5 hashing function from the file hashing.py and this vulnerability will be gone
References
https://www.cybersecurity-help.cz/vdb/cwe/916/
https://www.cybersecurity-help.cz/vdb/cwe/327/
https://www.cybersecurity-help.cz/vdb/cwe/328/
https://www.section.io/engineering-education/what-is-md5/
https://www.johndcook.com/blog/2019/01/24/reversing-an-md5-hash/
For more information
If you have any questions or comments about this advisory:
- Open an issue in Enrocrypt's Official Repo
- Create a Discussion in Enrocrypt's Official Repo
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2021-39182 has been found in enrocrypt.
Attackers can target a specific entry point like MD5 over the network to misuse the product.
Confidential information can be exposed externally.
What to do: upgrade enrocrypt to 1.1.4 or later.
If unsure, ask your IT team or search "enrocrypt CVE-2021-39182" on the vendor's site.
CVE-2021-39182 (enrocrypt) — CWE-326
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: MD5 / hashing.py
Patched: 1.1.4 — apply immediately
Workaround: If u specifically want a version and don't want to upgrade, you can remove the MD5 hashing function from the file hashing.py and this vulnerability will be gone
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-326) exists in enrocrypt. Attackers reach the vulnerable code path via MD5 without authentication.
Check the vendor advisory for the affected versions of enrocrypt. Attack surface: MD5 / hashing.py.
Severity: ?. Confidential information can be exposed externally.
Update to 1.1.4.
Workaround: If u specifically want a version and don't want to upgrade, you can remove the MD5 hashing function from the file hashing.py and this vulnerability will be gone
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'enrocrypt' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'enrocrypt' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
enrocryptを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
If u specifically want a version and don't want to upgrade, you can remove the `MD5` hashing function from the file `hashing.py` and this vulnerability will be goneパッチが適用されるまでの応急処置として、If u specifically want a version and don't want to upgrade, you can remove the
MD5hashing function from the filehashing.pyand this vulnerability will be gone を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade enrocrypt to 1.1.4ステージング環境で 1.1.4 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com