CVE-2024-22192: Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders

January 16, 2024 (updated January 19, 2024)

The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. Notably, a malicious verifier may be able to generate a unique identifier for a holder providing a verifiable presentation that includes a Non-Revocation proof.

References

github.com/advisories/GHSA-6698-mhxx-r84g
github.com/hyperledger-archives/ursa
github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g
github.com/hyperledger/anoncreds-clsignatures-rs/commit/1e55780c890b027fa51e361e188a7743a0bf473f
nvd.nist.gov/vuln/detail/CVE-2024-22192

Code Behaviors & Features

Detect and mitigate CVE-2024-22192 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →