CVE-2024-21669Disclosure(hyperledger / aries_cloud_agent)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch hyperledger aries_cloud_agent systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.

hyperledger CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-347

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

aries_cloud_agent

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

hyperledger

Products

aries_cloud_agent

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2024-21669/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters137d
Disclosure
CVE-2024-21669 - Critical flaw in Hyperledger ACA-Py. Verification of W3C Verifiable Credentials using JSON-LD LDP-VCs is flawed, allowing false validations. CVSS 9.9. No patch available. Monitor updates. #CVE #Blockchain #infosec #CVEAlert Get info: https://www.valtersit.com/cve/CVE-2024-21669/
Post summary
A newly disclosed critical vulnerability (CVE-2024-21669) in Hyperledger ACA‑Py improperly validates W3C Verifiable Credentials via JSON‑LD, carries a CVSS score of 9.9, and currently has no patch available.
0001039
919 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	hyperledger	aries_cloud_agent	-	python	-
App	hyperledger	aries_cloud_agent	0.11.0	python	-
App	hyperledger	aries_cloud_agent	0.11.0	python	-

Explore more

Back to dashboard hyperledger CVEs aries_cloud_agent vulnerabilities