Vulnerability · Published Mar 5, 2025 · Assigned by GitHub_M
CVE-2025-27508Emissary Use of a Broken or Risky Cryptographic Algorithm
High 7.5
In plain English
A high-severity broken cryptography in emissary from NationalSecurityAgency. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cryptographic guarantees are required. This issue is fixed in 8.24.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | gov.nsa.emissary:emissary | 8.24.0 | GHSA-hw43-fcmm-3m5g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NationalSecurityAgency | emissary | < 8.24.0 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N