CVE-2021-37588: 
NixOS vulnerability analysis and mitigation

In Charm 0.43, a cryptographic vulnerability was discovered that allows any two users to collude and gain the ability to decrypt YCT14 (Yao-Chen-Tian 2014) data. The vulnerability was disclosed on July 30, 2021 (CISA Bulletin, GitHub Issue).

The vulnerability exists in the YCT14 (Yao-Chen-Tian 2014) attribute-based encryption scheme implementation within the Charm cryptographic framework version 0.43. The scheme is a lightweight attribute-based encryption designed for Internet of Things applications, but contains a critical flaw that allows unauthorized decryption through user collusion (IACR ePrint).

When exploited, this vulnerability allows any two users to combine their credentials and gain unauthorized access to encrypted YCT14 data, effectively bypassing the intended access control mechanisms of the attribute-based encryption scheme (CISA Bulletin).

The vulnerability affects Charm version 0.43. Users should migrate to alternative attribute-based encryption schemes that are not vulnerable to collusion attacks. The YCT14 scheme implementation has been identified as broken and should not be used in production environments (GitHub Issue).