CVE-2021-4286 - cocagne pysrp _ctsrp.py calculate_x information exposure

Back Back to CVE browser

HIGH

cocagne pysrp _ctsrp.py calculate_x information exposure

Published Dec 27, 2022

8.7

HIGH

CVSS 4.0

EPSS 0.70%

Description

A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af1780561213ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875.

Affected products

Vendor Cocagne Product Pysrp Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  -
- Version
  1.0.1
  Status
  affected
  Constraints
  -
- Version
  1.0.10
  Status
  affected
  Constraints
  -
- Version
  1.0.11
  Status
  affected
  Constraints
  -
- Version
  1.0.12
  Status
  affected
  Constraints
  -
- Version
  1.0.13
  Status
  affected
  Constraints
  -
- Version
  1.0.14
  Status
  affected
  Constraints
  -
- Version
  1.0.15
  Status
  affected
  Constraints
  -
- Version
  1.0.16
  Status
  affected
  Constraints
  -
- Version
  1.0.2
  Status
  affected
  Constraints
  -
- Version
  1.0.3
  Status
  affected
  Constraints
  -
- Version
  1.0.4
  Status
  affected
  Constraints
  -
- Version
  1.0.5
  Status
  affected
  Constraints
  -
- Version
  1.0.6
  Status
  affected
  Constraints
  -
- Version
  1.0.7
  Status
  affected
  Constraints
  -
- Version
  1.0.8
  Status
  affected
  Constraints
  -
- Version
  1.0.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cocagne

Pysrp

n/a

Version	Status	Constraints
1.0.0	affected	-
1.0.1	affected	-
1.0.10	affected	-
1.0.11	affected	-
1.0.12	affected	-
1.0.13	affected	-
1.0.14	affected	-
1.0.15	affected	-
1.0.16	affected	-
1.0.2	affected	-
1.0.3	affected	-
1.0.4	affected	-
1.0.5	affected	-
1.0.6	affected	-
1.0.7	affected	-
1.0.8	affected	-
1.0.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-203

References (9)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0281
Advisory
https://github.com/advisories/GHSA-xmc3-9m9j-w9x4
Advisory
https://github.com/cocagne/pysrp/commit/dba52642f5e95d3da7af1780561213ee6053195f
patchThird Party Advisory
https://github.com/cocagne/pysrp/pull/43
issue-trackingPatchThird Party Advisory
https://github.com/cocagne/pysrp/releases/tag/1.0.17
patchRelease NotesThird Party Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/srp/PYSEC-2022-43014.yaml
https://nvd.nist.gov/vuln/detail/CVE-2021-4286
https://vuldb.com/?ctiid.216875
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.216875
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0281		Advisory
https://github.com/advisories/GHSA-xmc3-9m9j-w9x4		Advisory
https://github.com/cocagne/pysrp/commit/dba52642f5e95d3da7af1780561213ee6053195f		patchThird Party Advisory
https://github.com/cocagne/pysrp/pull/43		issue-trackingPatchThird Party Advisory
https://github.com/cocagne/pysrp/releases/tag/1.0.17		patchRelease NotesThird Party Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/srp/PYSEC-2022-43014.yaml
https://nvd.nist.gov/vuln/detail/CVE-2021-4286
https://vuldb.com/?ctiid.216875		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.216875		vdb-entrytechnical-descriptionThird Party Advisory