CVE-2024-21670

    Dashboard / Vulnerabilities / CVE-2024-21670

    CVE-2024-21670

    Published: 16 Jan 2024Last Modified: 12 Aug 2026

    Summary: CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential

    Details: Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that credential as part of an AnonCreds presentation. A verifier may verify a credential from a holder as being "not revoked" when in fact, the holder's credential has been revoked. Ursa has moved to end-of-life status and no fix is expected.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21670.json, https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-r78f-4q2q-hvv4, https://nvd.nist.gov/vuln/detail/CVE-2024-21670

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 28e9f632793bedb566efb5527d43b55aa904bafa
    Fixed -None

    Affected versions

    0.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-21670 | CVE-DB