PT-2020-8062 · Unknown+1 · Bitcoin Core+1

Sergio Demian Lerner + 1 · Published 2017-09-17 · Updated 2020-03-23 · CVE-2017-12842

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.14

Description: The issue allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would cost more than a million dollars, and is relevant mainly only in situations where an autonomous system relies solely on an SPV proof for transactions of a greater dollar amount.

Recommendations: For versions prior to 0.14, update to version 0.14 or later to resolve the issue. As a temporary workaround, consider restricting the reliance on SPV proofs for transactions of a greater dollar amount in autonomous systems.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-2217

CVE-2017-12842

Affected Products

Alt Linux

Bitcoin Core

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-12842 · Security Note
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12842 · Vendor Advisory
• https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-February/016697.html · Note
• https://bitslog.wordpress.com/2018/06/09/leaf-node-weakness-in-bitcoin-merkle-tree-design · Note
• https://t.me/cvenotify/1778 · Telegram Post
• https://t.me/cibsecurity/10532 · Telegram Post