{"id":"CVE-2021-39182","aliases":["GHSA-35m5-8cvj-8783","PYSEC-2021-385"],"url":"https://o3.security/vulnerability/CVE-2021-39182","summary":"Improper hashing in enrocrypt","details":"### Impact\nThe vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginner(and doesn't know about hashes)  can face problems as MD5 is considered a Insecure Hashing Algorithm. \n\n### Patches\nThe vulnerability is patched in v1.1.4 of the product, the users can upgrade to version 1.1.4.\n\n### Workarounds\nIf u specifically want a version and don't want to upgrade, you can remove the `MD5` hashing function from the file `hashing.py` and this vulnerability will be gone\n\n### References\nhttps://www.cybersecurity-help.cz/vdb/cwe/916/\nhttps://www.cybersecurity-help.cz/vdb/cwe/327/\nhttps://www.cybersecurity-help.cz/vdb/cwe/328/\nhttps://www.section.io/engineering-education/what-is-md5/\nhttps://www.johndcook.com/blog/2019/01/24/reversing-an-md5-hash/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [**Enrocrypt's Official Repo**](http://www.github.com/Morgan-Phoenix/EnroCrypt)\n* Create a Discussion in  [**Enrocrypt's Official Repo**](http://www.github.com/Morgan-Phoenix/EnroCrypt)\n","published":"2021-11-08T15:15:07.933Z","modified":"2026-08-27T08:15:05.541020Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"enrocrypt","fixedVersion":"1.1.4"}],"fix":{"url":"https://github.com/Morgan-Phoenix/EnroCrypt/commit/e652d56ac60eadfc26489ab83927af13a9b9d8ce","label":"Morgan-Phoenix/EnroCrypt@e652d56"},"references":[{"type":"ADVISORY","url":"https://github.com/Morgan-Phoenix/EnroCrypt/security/advisories/GHSA-35m5-8cvj-8783"},{"type":"EVIDENCE","url":"https://github.com/Morgan-Phoenix/EnroCrypt/commit/e652d56ac60eadfc26489ab83927af13a9b9d8ce"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39182"},{"type":"PACKAGE","url":"https://github.com/Morgan-Phoenix/EnroCrypt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/enrocrypt/PYSEC-2021-385.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T08:15:05.541020Z"}}