CVE-2024-22192

    Dashboard / Vulnerabilities / CVE-2024-22192

    CVE-2024-22192

    Published: 16 Jan 2024Last Modified: 12 Aug 2026

    Summary: Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders

    Details: Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. Notably, a malicious verifier may be able to generate a unique identifier for a holder providing a verifiable presentation that includes a Non-Revocation proof. The impact of the flaw is that a malicious verifier may be able to determine a unique identifier for a holder presenting a Non-Revocation proof. Ursa has moved to end-of-life status and no fix is expected.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22192.json, https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-6698-mhxx-r84g, https://nvd.nist.gov/vuln/detail/CVE-2024-22192

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 28e9f632793bedb566efb5527d43b55aa904bafa
    Fixed -None

    Affected versions

    0.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-22192 | CVE-DB