PT-2021-20371 · Unknown+1 · Bitcoin Core+1

Achow101 + 1 · Published 2019-11-11 · Updated 2021-02-08 · CVE-2021-3401

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.19.0

Description: The issue might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program. This could be demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. The discoverer notes that they believe this issue cannot actually be exploited.

Recommendations: For versions prior to 0.19.0, update to version 0.19.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the -platformpluginpath argument in the bitcoin-qt program to minimize the risk of exploitation.

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

ALT-PU-2019-3115

ALT-PU-2020-2733

CVE-2021-3401

Affected Products

Alt Linux

Bitcoin Core

References · 5

• https://github.com/bitcoin/bitcoin/pull/16578 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3401 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3401 · Vendor Advisory
• https://achow101.com/2021/02/0.18-uri-vuln · Note
• https://t.me/cvenotify/9386 · Telegram Post