Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
Description
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation document.proof was not factored into the final verified value (true/false) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
aries-cloudagentPyPI | >= 0.7.0, < 0.10.5 | 0.10.5 |
aries-cloudagentPyPI | >= 0.11.0rc1, < 0.11.0 | 0.11.0 |
Affected products
2- Range: >= 0.7.0, < 0.10.5
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-97x9-59rv-q5pmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-21669ghsaADVISORY
- github.com/hyperledger/aries-cloudagent-python/commit/0b01ffffc0789205ac990292f97238614c9fd293ghsax_refsource_MISCWEB
- github.com/hyperledger/aries-cloudagent-python/commit/4c45244e2085aeff2f038dd771710e92d7682ff2ghsax_refsource_MISCWEB
- github.com/hyperledger/aries-cloudagent-python/releases/tag/0.10.5ghsax_refsource_MISCWEB
- github.com/hyperledger/aries-cloudagent-python/releases/tag/0.11.0ghsax_refsource_MISCWEB
- github.com/hyperledger/aries-cloudagent-python/security/advisories/GHSA-97x9-59rv-q5pmghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.