Improper Authentication Affecting aries-cloudagent package, versions [,0.10.5) [0.11.0rc1,0.11.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ARIESCLOUDAGENT-6150377
- published 10 Jan 2024
- disclosed 9 Jan 2024
- credit Daniel Bluhm
Introduced: 9 Jan 2024
CVE-2024-21669 Open this link in a new tabHow to fix?
Upgrade aries-cloudagent to version 0.10.5, 0.11.0 or higher.
Overview
aries-cloudagent is a Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments.
Affected versions of this package are vulnerable to Improper Authentication due to faulty verification of the document.proof during the presentation process. An attacker can manipulate the presentation of credentials to appear as verified despite the presence of errors or mismatches in the challenge, potentially leading to unauthorized access or actions.