PT-2019-14817 · Bitcoin · Slp-Validate

Jcramer · Published 2019-11-15 · Updated 2019-11-19 · CVE-2019-16761

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions slp-validate versions prior to 1.0.1

Description A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate package. This allows an attacker to create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus.

Recommendations For versions prior to 1.0.1, upgrade to version 1.0.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-16761

GHSA-WMX6-VXCF-C3GR

Affected Products

Slp-Validate

References · 7

• https://github.com/simpleledger/slp-validate/commit/50ad96c2798dad6b9f9a13333dd05232defe5730#diff-fe58606994c412ba56a65141a7aa4a62L123 · Patch
• https://github.com/simpleledger/slp-validate/security/advisories/GHSA-wmx6-vxcf-c3gr · Patch
• https://osv.dev/vulnerability/GHSA-wmx6-vxcf-c3gr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16761 · Security Note
• https://github.com/advisories/GHSA-wmx6-vxcf-c3gr · Note
• https://npmjs.com/advisories/1422 · Note