PT-2019-14488 · Bitcoin+1 · Bitcoin Core+1

Oxagast · Published 2019-08-04 · Updated 2022-05-03 · CVE-2019-15947

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bitcoin Core version 0.18.0

Description The issue concerns the storage of wallet.dat data in memory by bitcoin-qt. When the program crashes, it may create a core file that contains unencrypted wallet data. If this core file is not handled properly, an attacker could potentially reconstruct the wallet.dat file, including private keys, by using a specific command.

Recommendations For Bitcoin Core version 0.18.0, consider updating to a newer version that addresses this issue, as storing sensitive data unencrypted in memory poses a significant risk. Additionally, handle core files with care to prevent unauthorized access, and avoid using commands that could expose sensitive information, such as private keys.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

ALT-PU-2019-2361

ALT-PU-2019-3097

CVE-2019-15947

MGASA-2020-0458

Affected Products

Alt Linux

Bitcoin Core

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2019-15947 · Security Note
• https://security.gentoo.org/glsa/202009-18 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0458.html · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0458 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15947 · Vendor Advisory
• https://github.com/bitcoin/bitcoin/issues/16824 · Note
• https://t.me/secharvester/12039 · Telegram Post
• https://gist.github.com/oxagast/50a121b2df32186e0c48411859d5861b · Note
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2019-15947 · Note
• https://bugs.mageia.org/show_bug.cgi?id=27731 · Note