CVE-2019-16762

Опубликовано: 15 нояб. 2019

Источник: nvd

CVSS3: 5.7

CVSS3: 6.1

CVSS2: 4.9

EPSS Низкий

Описание

A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any version >= 0.21.4.

Ссылки

https://github.com/simpleledger/slpjs/commit/ac8809b42e47790a6f0205991b36f2699ed10c84#diff-fe58606994c412ba56a65141a7aa4a62L701
Patch
Third Party Advisory
https://github.com/simpleledger/slpjs/security/advisories/GHSA-425c-ccf3-3jrr
Exploit
Patch
Third Party Advisory
https://github.com/simpleledger/slpjs/commit/ac8809b42e47790a6f0205991b36f2699ed10c84#diff-fe58606994c412ba56a65141a7aa4a62L701
Patch
Third Party Advisory
https://github.com/simpleledger/slpjs/security/advisories/GHSA-425c-ccf3-3jrr
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:simpleledger:slpjs:*:*:*:*:*:node.js:*:*

Версия до 0.21.4 (исключая)

EPSS

Процентиль: 60%

0.00392

Низкий

5.7 Medium

CVSS3

6.1 Medium

CVSS3

4.9 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-425c-ccf3-3jrr

CVSS3: 5.7

github

около 6 лет назад

Critical severity vulnerability that affects slpjs

EPSS

Процентиль: 60%

0.00392

Низкий

5.7 Medium

CVSS3

6.1 Medium

CVSS3

4.9 Medium

CVSS2

Дефекты

CWE-20