CVE-2022-29161: Use of a Broken or Risky Cryptographic Algorithm in XWiki Crypto API
Summary
CVE-2022-29161: Use of a Broken or Risky Cryptographic Algorithm in XWiki Crypto API. Affects org.xwiki.platform:xwiki-platform-crypto across 2 version ranges.
< 13.10.6
>= 14.0.0, < 14.3.1
Fixed in 13.10.6 or 14.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki Crypto API is a component of the XWiki platform that provides cryptographic functionality. It is used to generate X509 certificates, which are commonly used for secure communication and authentication. However, the default algorithm used for signing these certificates, SHA1 with RSA, is no longer considered safe due to the risk of collisions with SHA1. This vulnerability affects versions 0 to 13.10.6 and 14.0.0 to 14.3.1 of the org.xwiki.platform:xwiki-platform-crypto package.
Vulnerability Detail
The use of SHA1 with RSA for certificate signatures poses a security risk as it is vulnerable to collision attacks. An attacker could potentially generate a different certificate with the same signature, leading to impersonation or other malicious activities. This vulnerability has a CVSS score of 5.4, indicating a moderate severity level. It is important to upgrade to the patched versions (13.10.6, 14.3.1, or 14.4-rc-1) to mitigate this risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 13.10.613.10.6 -
>= 14.0.0, < 14.3.114.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to patch the xwiki-platform-crypto module locally. This can be done by applying the change provided in the following GitHub commit: [link to commit]. After applying the patch, the module needs to be recompiled.
Conclusion
The use of SHA1 with RSA for certificate signatures in XWiki Crypto API poses a security risk. It is crucial to upgrade to the patched versions (13.10.6, 14.3.1, or 14.4-rc-1) or apply the provided patch to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-crypto →
FAQ
XWiki Crypto API is a component of the XWiki platform that provides cryptographic functionality. It is used for generating X509 certificates.
SHA1 with RSA is no longer considered safe for certificate signatures due to the risk of collisions. This means that an attacker could generate a different certificate with the same signature, leading to potential security breaches.
This vulnerability could allow an attacker to impersonate a trusted entity by generating a malicious certificate with the same signature. This could lead to unauthorized access, data breaches, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and it will analyze the dependencies for any known vulnerabilities.
The recommended way to mitigate this vulnerability is to upgrade to one of the patched versions. However, if upgrading is not immediately possible, applying the provided patch locally can serve as a temporary workaround.
