PT-2019-15571 · Shapeshift · Keepkey

Christian Reitter · Published 2019-12-06 · Updated 2024-03-08 · CVE-2019-18672

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ShapeShift KeepKey hardware wallet versions prior to 6.2.2

Description The issue is related to insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet. This allows a partial reset of cryptographic secrets to known values via crafted messages, which can be sent by unauthenticated attackers through the WebUSB interface. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations.

Recommendations For versions prior to 6.2.2, update the firmware to version 6.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebUSB interface to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2019-18672

Affected Products

Keepkey

References · 7

• https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-18672 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18672 · Vendor Advisory
• https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 · Note
• https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 · Note
• https://twitter.com/Esparta6108713/status/1766337426027331933 · Twitter Post
• https://blog.inhq.net/posts/keepkey-CVE-2019-18672 · Note