PT-2019-14812 · Decentralized Anonymous Payment System+1 · Daps+1

Published 2019-12-04 · Updated 2019-12-27 · CVE-2019-16753

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Decentralized Anonymous Payment System (DAPS) versions through 2019-08-26 Private Instant Verified Transactions (PIVX) versions through 3.4.0

Description A weak signature scheme design issue allows the reuse of signatures in certain cases, potentially enabling the reuse of signatures intended for one type of message for another. This is due to the content to be signed being composed of a representation of strings rather than their binary representations.

Recommendations For Decentralized Anonymous Payment System (DAPS) versions through 2019-08-26, update to a version released after 2019-08-26 to resolve the issue. For Private Instant Verified Transactions (PIVX) versions through 3.4.0, update to a version later than 3.4.0 to fix the problem.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2019-16753

Affected Products

Daps

Pivx

References · 3

• 🔥 https://officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16753 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16753 · Vendor Advisory