GHSA-vhmj-5q9r-mm9g: Edumfa BlastRADIUS Also Affects EduMFA Vulnerability

MODERATE
Share
CVSS 6.8
CWE-924
Published
Advisory Summary

GHSA-vhmj-5q9r-mm9g is a MODERATE (CVSS 6.8) blastradius also affects edumfa vulnerability (CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel) affecting Edumfa libraries in the PyPI ecosystem. The issue involves blastradius also affects edumfa. Remediation is available by upgrading affected packages to version 2.2.0.

GHSA-vhmj-5q9r-mm9g at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-vhmj-5q9r-mm9g
Severity MODERATE
CVSS v3.1 Base Score 6.8
CWE Classification CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Affected Product Edumfa
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 6.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix GHSA-vhmj-5q9r-mm9g

To remediate this vulnerability, upgrade all affected Edumfa dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

edumfa fixed: 2.2.0 
pip install edumfa>=2.2.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show edumfa

How to Check if You Are Affected

To determine whether your Python environment is affected by GHSA-vhmj-5q9r-mm9g, inspect your installed packages using pip:

pip show edumfa

Analyze the terminal output to locate any version of Edumfa in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.2.0), your application is affected.

Note: The pip show edumfa command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel, where the product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission. In Edumfa, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary BlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. ### Details Website with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 ### PoC There is no known proof-of-concept except for the attack shown in the paper from the researchers ### Impact An attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject.

GHSA-vhmj-5q9r-mm9g Affected Edumfa Versions

1 component(s)
Fixed Versions:
2.2.0
Product / Package Ecosystem Affected Versions Fixed Version
edumfa
pypi/edumfa
PyPI
< 2.2.0
2.2.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/eduMFA/eduMFA/security/advisories/GHSA-vhmj-5q9r-mm9g
NVD — GHSA-vhmj-5q9r-mm9g NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3596
Security Fix Commit FIX COMMIT
https://github.com/eduMFA/eduMFA/commit/ad9d18be31e8a6f536c646dc037d945de33fac60
Edumfa Source Repository REPOSITORY
https://github.com/eduMFA/eduMFA
kb.cert.org/vuls/id/456537 WEB
https://kb.cert.org/vuls/id/456537

Frequently Asked Questions

What is GHSA-vhmj-5q9r-mm9g?
GHSA-vhmj-5q9r-mm9g is a security vulnerability in Edumfa involving BlastRADIUS also affects eduMFA under CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel.
Which Edumfa versions are affected?
Affected versions include releases prior to 2.2.0 across affected packages: edumfa.
What version fixes GHSA-vhmj-5q9r-mm9g?
Upgrading to 2.2.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is edumfa affected?
Yes, edumfa is affected in releases prior to 2.2.0. Upgrade your dependency to 2.2.0 or later.
What is the CVSS score of GHSA-vhmj-5q9r-mm9g?
GHSA-vhmj-5q9r-mm9g has a CVSS v3.1 base score of 6.8 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
What CWE is associated with GHSA-vhmj-5q9r-mm9g?
GHSA-vhmj-5q9r-mm9g is classified under CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel (The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.).
How can I check PyPI dependencies for GHSA-vhmj-5q9r-mm9g?
Run the dependency tree command: 'pip show edumfa'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vhmj-5q9r-mm9g",
  "modified" : "2024-07-17T16:01:37Z",
  "published" : "2024-07-17T16:01:37Z",
  "aliases" : [ ],
  "summary" : "BlastRADIUS also affects eduMFA",
  "details" : "### Summary\nBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked.\n\n### Details\nWebsite with the vulnerability information blastradius.fail\nThe original vulnerability has been assigned CVE-2024-3596\nCase in vince: https://kb.cert.org/vuls/id/456537\n\n### PoC\nThere is no known proof-of-concept except for the attack shown in the paper from the researchers \n\n### Impact\nAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "edumfa"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.2.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/eduMFA/eduMFA/security/advisories/GHSA-vhmj-5q9r-mm9g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-3596"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/eduMFA/eduMFA/commit/ad9d18be31e8a6f536c646dc037d945de33fac60"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/eduMFA/eduMFA"
  }, {
    "type" : "WEB",
    "url" : "https://kb.cert.org/vuls/id/456537"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-924" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-07-17T16:01:37Z",
    "nvd_published_at" : null
  }
}