CVE-2024-40761

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Inadequate Encryption Strength vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Answer	<= 1.3.5
apache	answer	<= 1.3.5

References

https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08xMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/5Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/6Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/7Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/26/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/26/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/26/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/27/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/27/5Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/27/8Mailing List, Third Party Advisory

Timeline

Published: Sep 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-407629.8Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain ca CVE-2024-407637.5Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers CVE-2024-407647.5Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS)CVE-2024-407659.8An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of S CVE-2024-407669.8An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized CVE-2024-407676.5In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 im CVE-2024-40777.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign allows Reflected X CVE-2024-407707.5A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able t CVE-2024-407717.8The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS CVE-2024-407747.1A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Monterey 1 CVE-2024-407755.5A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, CVE-2024-407764.3A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS