Broken or risky cryptographic algorithm in Morgan-Phoenix EnroCrypt
Priority LOW 34CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.
Summary
EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`.
Why it matters now
EPSS 0.00562 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed EnroCrypt (Morgan-Phoenix): 1.1.4enrocrypt (PyPI): 1.1.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Morgan-Phoenix | EnroCrypt | before 1.1.4 | 1.1.4 | Patch available | CNA |
| — | enrocrypt (PyPI) | before 1.1.4 | 1.1.4 | Patch available | GHSA-35m5-8cvj-8783 |
- EnroCrypt VendorMorgan-Phoenix Affected before 1.1.4 Fixed in 1.1.4 Patch available CNA
- enrocrypt (PyPI) Vendor— Affected before 1.1.4 Fixed in 1.1.4 Patch available GHSA-35m5-8cvj-8783
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:enrocrypt_project:enrocrypt:*:*:*:*:*:*:*:* | before 1.1.4 | Vulnerable | Enrocrypt Project |
- cpe:2.3:a:enrocrypt_project:enrocrypt:*:*:*:*:*:*:*:* Versions before 1.1.4 Vulnerable ·Enrocrypt Project
Remediation
- Fix · CNA EnroCrypt (Morgan-Phoenix) Fixed in 1.1.4
- Fix · GHSA-35m5-8cvj-8783 enrocrypt (PyPI) Fixed in 1.1.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-39182
- 2026-10-03 Alias added: GHSA-35m5-8cvj-8783
References
Exploit 1
Advisory 2
Sources
- CVE-2021-39182 · CVE Program
- CVE-2021-39182 · NVD
- FIRST EPSS
- GHSA-35m5-8cvj-8783 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences