PT-2019-14488 · Bitcoin+1 · Bitcoin Core+1

Oxagast · Publicado 2019-08-04 · Atualizado 2022-05-03 · CVE-2019-15947

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bitcoin Core version 0.18.0

Description The issue concerns the storage of wallet.dat data in memory by bitcoin-qt. When the program crashes, it may create a core file that contains unencrypted wallet data. If this core file is not handled properly, an attacker could potentially reconstruct the wallet.dat file, including private keys, by using a specific command.

Recommendations For Bitcoin Core version 0.18.0, consider updating to a newer version that addresses this issue, as storing sensitive data unencrypted in memory poses a significant risk. Additionally, handle core files with care to prevent unauthorized access, and avoid using commands that could expose sensitive information, such as private keys.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

ALT-PU-2019-2361

ALT-PU-2019-3097

CVE-2019-15947

MGASA-2020-0458

Produtos afetados

Alt Linux

Bitcoin Core

Referências · 10

• https://github.com/bitcoin/bitcoin/issues/16824 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15947 · Nota de Segurança
• https://t.me/secharvester/12039 · Publicação no Telegram
• https://security.gentoo.org/glsa/202009-18 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2020-0458.html · Nota de Segurança
• https://gist.github.com/oxagast/50a121b2df32186e0c48411859d5861b · Nota
• https://osv.dev/vulnerability/MGASA-2020-0458 · Aviso do Fabricante
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2019-15947 · Nota
• https://osv.dev/vulnerability/CVE-2019-15947 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=27731 · Nota