CVE-2021-37587: In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data

Medium severity · published Jul 30, 2021

CVE-2021-37587

In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data

6.5

CVSS

0.8%

EPSS

On KEV

Description

In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 57% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Charm · Jhu

0.43 · source: NVD

Affected product

Charm

Jhu

All Charm CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-37587

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-37587

Third Party Advisory

https://eprint.iacr.org/2020/460

Issue Tracking

https://github.com/JHUISI/charm/issues/276

Patch

https://jhuisi.github.io/charm/_modules/abenc_maabe_yj14.html

Third Party Advisory

https://jhuisi.github.io/charm/charm/schemes/abenc/abenc_dacmacs_yj14.html

Technical Description

https://www2.hci.uni-hannover.de/papers/Tan2019.pdf