VulnerabilityAnalyzed
CVE-2024-45719
Inadequate Encryption Strength vulnerability in Apache Answer.
LOW 2.6EPSS 0.25%
Does this matter?
Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.
Description
Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
- CVSS 3.1
- 2.6 LOWCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
- EPSS
- 0.25% probability · 16th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-326
- Affected
- apache/answer
- Source
- security@apache.org
References
- https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/11/22/1Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.