CVE-2021-4286 json
cocagne pysrp _ctsrp.py calculate_x information exposure
published 3y ago modified 4mo ago also GHSA-xmc3-9m9j-w9x4 , PYSEC-2022-43014 , EUVD-2022-0281
- cvss
- 2.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af1780561213ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875.
Patch / fix
- pypi srp 1.0.17
- pysrp_project pysrp 1.0.17
- github.com/cocagne/pysrp@dba5264 commit
- github.com/cocagne/pysrp#43 pull request
- github.com/cocagne/pysrp/releases/tag/1.0.17 release
Is CVE-2021-4286 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.6 | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.0 | 2.6 | CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | srp | <1.0.17 |
1.0.17 |
Affected products
- cocagne pysrp
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
github.com
/cocagne/pysrp/pull/43
issue-tracking, web, patch, third-party-advisory
-
github.com
/cocagne/pysrp/commit/dba52642f5e95d3da7af1780561213ee6053195f
patch, web, third-party-advisory
-
github.com
/cocagne/pysrp/releases/tag/1.0.17
patch, web, release-notes, third-party-advisory
-
vuldb.com
/?id.216875
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.216875
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-4286
advisory
-
github.com
/cocagne/pysrp
package
-
github.com
/pypa/advisory-database/tree/main/vulns/srp/PYSEC-2022-43014.yaml
web
-
github.com
/advisories/GHSA-xmc3-9m9j-w9x4
advisory
Sources
- CVE List CVE-2021-4286
- GitHub Advisory GHSA-xmc3-9m9j-w9x4
- NVD CVE-2021-4286
- OSV PYSEC-2022-43014
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.