Cyber Resilience

CVE-2024-45719

Crypto Weakness in Apache Answer ≤ 1.4.1

Crypto Weakness
Published
22 November 2024
Modified
01 July 2025
Patch / advisory
View advisory
CVSS Score v3.1 2.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0023 14th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2024-45719 is a low-severity Inadequate Encryption Strength (CWE-326) vulnerability in Apache Answer. Its CVSS base score is 2.6 (Low).

Operationally, ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are…

more

recommended to upgrade to version 1.4.1, which fixes the issue.

CWE(s)
CWE-326

Related Threats

CVEs Like This One

CVE-2024-40761Same product: Apache Answer
CVE-2026-34031Same product: Apache Answer
CVE-2026-34905Same product: Apache Answer
CVE-2026-25700Same product: Apache Answer
CVE-2024-23349Same product: Apache Answer
CVE-2026-34033Same product: Apache Answer
CVE-2025-29868Same product: Apache Answer
CVE-2026-24735Same product: Apache Answer
CVE-2024-22393Same product: Apache Answer
CVE-2024-41888Same product: Apache Answer

Affected Assets

apache
answer
≤ 1.4.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 14 hardening rules · 7 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V11.4.2
  • V14.1.2
  • V14.2.4

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

PM-15 Security and Privacy Groups and Associations
addresses: CWE-326

Maintaining currency with technologies and practices reduces selection of encryption mechanisms that provide inadequate strength.

RA-4 Risk Assessment Update
addresses: CWE-326

Updated assessments identify when previously adequate encryption strength no longer meets current attack capabilities or compliance drivers.

SC-12 Cryptographic Key Establishment and Management
addresses: CWE-326

Establishment procedures require selection and generation of keys with adequate length and strength for the chosen algorithm.

SC-13 Cryptographic Protection
addresses: CWE-326

Specifies required cryptography types and parameters, preventing selection of inadequate encryption strength.

SI-2 Flaw Remediation
addresses: CWE-326

Prompt patching corrects inadequate encryption strength when vendors release updates that increase key sizes or algorithm security.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match
prevents

Strong encryption is required to protect confidentiality of data-at-rest.

PR.DS-02 mostly match
prevents

Strong encryption is required to protect confidentiality of data-in-transit.

PR.PS-01 partial match
prevents

Hardened baselines can enforce minimum cryptographic algorithm and key-length settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography partial match
prevents

Requiring the organization to define and enforce minimum cryptographic strength prevents deployment of insufficient key lengths or weak ciphers that can be brute-forced.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. via CWE-326
Oracle Linux 9 (1 rule)
  • V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
RHEL 8 (1 rule)
  • V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
RHEL 9 (1 rule)
  • V-257879 RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
Windows Server 2016 (1 rule)
  • V-224843 Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326
Windows Server 2019 (1 rule)
  • V-205727 Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326
Windows Server 2022 (1 rule)
  • V-254262 Windows Server 2022 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326

References