CVE-2024-45719

Description

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.

Reserved 2024-09-05 | Published 2024-11-22 | Updated 2024-11-22 | Assigner apache

Problem types

CWE-326 Inadequate Encryption Strength

Product status

Default status
unaffected

Any version
affected

Credits

Chi Tran from Eevee reporter

References

lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491 vendor-advisory

cve.org (CVE-2024-45719)

nvd.nist.gov (CVE-2024-45719)

Download JSON