PT-2020-14210 · Simple Ledger Protocol · Slpjs

Jcramer · Published 2020-07-30 · Updated 2020-08-03 · CVE-2020-15130

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions slpjs versions prior to 0.27.4

Description The issue concerns false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as required by the NFT1 specification.

Recommendations Upgrade to slpjs version 0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the creation of NFT1 child tokens until the update is applied.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2020-15130

GHSA-CC2P-4JHR-XHHX

Affected Products

Slpjs

References · 5

• https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c · Patch
• https://osv.dev/vulnerability/GHSA-cc2p-4jhr-xhhx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15130 · Security Note
• https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx · Note