[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <dbf738ce-d236-4c8b-864d-900d4e7c3238@rub.de>
Date: Fri, 27 Sep 2024 14:49:00 +0200
From: Fabian Bäumer <fabian.baeumer@....de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked
user email addresses
> I don't think that a seeded PRF (with a per-server seed) would meet
> the requirements here.
I think you are right. When I wrote my response yesterday I wasn't fully
aware how Gravatar is supposed to be used. I always thought of Gravatar
as a service to generate unique avatar images.
Now, this leaves me with a few observations:
1. The 'should be taken' from Gravatar's documentation should be 'must
be taken' to ensure consistent user hashes (therefore using MD5 in
the first place rendered Gravatar useless if Gravatar doesn't match
against MD5 hashes as well).
2. The information leakage with Gravatar is in-spec. Fixing the
information leakage would be possible but requires changes on
Gravatar's side by implementing a symmetric cipher instead of a hash
(as suggested; a hash wouldn't be tractable any more because
Gravatar would need to hash every user's email address with every
registered seed when using seeded PRF). Prior hashing wouldn't even
be required given that both sides - Gravatar and the site itself -
have access to the user's email address anyway.
3. It may be advisable to not use Gravatar as the default (not sure if
this is the case here). Instead, let user's choose it and let them
know about the potential information leakage.
4. The fix does not fix what it tries to fix.
5. Assigning a CVE for an in-spec information leakage seems not useful
to me. Otherwise, every single product using Gravatar would be
affected by this.
M. Sc. Fabian Bäumer
Chair for Network and Data Security
Ruhr University Bochum
Universitätsstr. 150, Building MC 4/145
44780 Bochum
Germany
Am 27.09.2024 um 14:25 schrieb Alexander Patrakov:
> On Thu, Sep 26, 2024 at 5:19 AM Demi Marie Obenour
> <demi@...isiblethingslab.com> wrote:
>> On Wed, Sep 25, 2024 at 06:28:16AM +0000, Enxin Xie wrote:
>>> Severity: low
>>>
>>> Affected versions:
>>>
>>> - Apache Answer through 1.3.5
>>>
>>> Description:
>>>
>>> Inadequate Encryption Strength vulnerability in Apache Answer.
>>>
>>> This issue affects Apache Answer: through 1.3.5.
>>>
>>> Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead.
>>> Users are recommended to upgrade to version 1.4.0, which fixes the issue.
>>>
>>> Credit:
>>>
>>> 张岳熙 (reporter)
>>>
>>> References:
>>>
>>> https://answer.incubator.apache.org
>>> https://www.cve.org/CVERecord?id=CVE-2024-40761
>> What is the specific property of SHA256 required here? Email addresses
>> have low entropy and I suspect they can be easily brute-forced, so
>> leaking the SHA256 has is still bad. Instead, I would use a seeded PRF
>> with a seed only known to the server, ensuring that the resulting value
>> does not leak any information about the email.
>> --
>> Sincerely,
>> Demi Marie Obenour (she/her/hers)
>> Invisible Things Lab
> I don't think that a seeded PRF (with a per-server seed) would meet
> the requirements here. The problem is that Gravatar would have no way
> of understanding which email is in question. Indeed, that would
> require storing all emails hashed with all registered server seeds.
>
> What would work is an email hash encrypted symmetrically with a
> per-server key. Then Gravatar (who also knows this key) would decrypt
> the email hash and look up the avatar image.
>
> Note that all of the above talks about a hypothetical improved version
> of Gravatar, not what we have right now.
>
Content of type "text/html" skipped
Download attachment "smime.p7s" of type "application/pkcs7-signature" (6214 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
