CVE-2024-21670

Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that credential as part of an AnonCreds presentation. A verifier may verify a credential from a holder as being "not revoked" when in fact, the holder's credential has been revoked. Ursa has moved to end-of-life status and no fix is expected.

• CWE-327

• https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-r78f-4q2q-hvv4Vendor Advisory
• https://github.com/hyperledger-archives/ursa/security/advisories/GHSA-r78f-4q2q-hvv4Vendor Advisory

Published

Jan 16, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21665ecommerce-framework-bundle is the Pimcore Ecommerce Framewor…4.3
• CVE-2024-21666The Customer Management Framework (CMF) for Pimcore adds fun…6.5
• CVE-2024-21667pimcore/customer-data-framework is the Customer Management F…6.5
• CVE-2024-21668react-native-mmkv is a library that allows easy use of MMKV …4.9
• CVE-2024-21669Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundatio…8.8
• CVE-2024-2167Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-21671The vantage6 technology enables to manage and deploy privacy…3.7
• CVE-2024-21672This High severity Remote Code Execution (RCE) vulnerability…8.8
• CVE-2024-21673This High severity Remote Code Execution (RCE) vulnerability…8.8
• CVE-2024-21674This High severity Remote Code Execution (RCE) vulnerability…7.5
• CVE-2024-21675Rejected reason: To maintain compliance with CNA rules, we h…
• CVE-2024-21676Rejected reason: This CVE's publication may have been a fals…