CVE-2024-21669: Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
(updated )
When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation document.proof was not factored into the final verified value (true/false) on the presentation record. Below is an example result from verifying a JSON-LD Presentation where there is an error noted in the processing (mismatched challenge), but the overall result is incorrectly "verified": true:
References
- github.com/advisories/GHSA-97x9-59rv-q5pm
- github.com/hyperledger/aries-cloudagent-python/commit/0b01ffffc0789205ac990292f97238614c9fd293
- github.com/hyperledger/aries-cloudagent-python/commit/4c45244e2085aeff2f038dd771710e92d7682ff2
- github.com/hyperledger/aries-cloudagent-python/releases/tag/0.10.5
- github.com/hyperledger/aries-cloudagent-python/releases/tag/0.11.0
- github.com/hyperledger/aries-cloudagent-python/security/advisories/GHSA-97x9-59rv-q5pm
- github.com/pypa/advisory-database/tree/main/vulns/aries-cloudagent/PYSEC-2026-284.yaml
- nvd.nist.gov/vuln/detail/CVE-2024-21669
- pypi.org/project/aries-cloudagent
Code Behaviors & Features
Detect and mitigate CVE-2024-21669 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →