CVE-2024-24553: Bludit uses SHA1 as Password Hashing Algorithm

Published Jun 24, 2024
·
Updated

Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure function.

Affected Software

2 affected components
Bludit bludit
Bludit bludit>=3.14.0<=3.15.0

Remediation

Information

To address this vulnerability, it is imperative that the Bludit development team transitions to a more secure and intentionally slow hashing algorithm, such as bcrypt or Argon2, for password storage. These algorithms introduce the necessary computational overhead to resist brute-force attacks effectively. In addition, it is advised that appropriate cost factors are used. Furthermore, the generation of password salts should be revamped to employ a cryptographically secure method. The current approach, utilizing the `Text::randomText function`, should be replaced with a robust random number generator provided by the operating system or a dedicated cryptographic library. This change ensures the creation of unpredictable and secure salts, enhancing the overall resilience of the password storage mechanism.

Event History

Jun 24, 2024
CVE Published
via MITRE·07:10 AM
Data Sourced
via MITRE·07:10 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-24553?

CVE-2024-24553 is considered a high-severity vulnerability due to the use of SHA-1 hashing for password protection.

2

How do I fix CVE-2024-24553?

To fix CVE-2024-24553, update Bludit to a version that uses a more secure hashing algorithm, such as bcrypt.

3

What impact does CVE-2024-24553 have on users?

CVE-2024-24553 allows attackers to potentially recover user passwords through brute-force attacks due to weaknesses in SHA-1 and the non-cryptographically secure salt.

4

Are older versions of Bludit affected by CVE-2024-24553?

Yes, older versions of Bludit that use the SHA-1 hashing algorithm for passwords are affected by CVE-2024-24553.

5

Is there a workaround for CVE-2024-24553?

A temporary workaround for CVE-2024-24553 is to implement additional rate limiting on login attempts while awaiting a patch.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203