PT-2024-30937 · Unknown · Miniscript

Sanket1729 · Published 2024-08-18 · Updated 2024-09-06 · CVE-2024-44073

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Miniscript library versions prior to 12.2.0

Description The issue allows stack consumption because the Miniscript library does not properly track tree depth.

Recommendations For versions prior to 12.2.0, update to version 12.2.0 or later to resolve the issue.

Fix

Uncontrolled Recursion

Memory Corruption

Allocation of Resources Without Limits

Weakness Enumeration

CWE-674

CWE-787

CWE-770

Related Identifiers

CVE-2024-44073

GHSA-RV9V-R4VM-GJ8X

Affected Products

Miniscript

References · 19

• https://github.com/rust-bitcoin/rust-miniscript/pull/704 · Patch
• https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0 · Patch
• https://github.com/rust-bitcoin/rust-miniscript/pull/712 · Patch
• https://osv.dev/vulnerability/CVE-2024-44073 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rv9v-r4vm-gj8x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44073 · Security Note
• https://github.com/rust-bitcoin/rust-miniscript/pull/713/files · Note
• https://github.com/rust-bitcoin/rust-miniscript/pull/714/files · Note
• https://github.com/rust-bitcoin/rust-miniscript/pull/715/files · Note
• https://github.com/rust-bitcoin/rust-miniscript/pull/712/files · Note
• https://github.com/rust-bitcoin/rust-miniscript/commit/5b0f5e3417f027a22b066debf825dbe6644b575b · Note
• https://github.com/rust-bitcoin/rust-miniscript/commit/8f54b5e3fb7129ed9fbed53f1cb9e6e62ea4c151 · Note
• https://twitter.com/cracbot/status/1827224375982223796 · Twitter Post
• https://t.me/cvenotify/91481 · Telegram Post
• https://twitter.com/cracbot/status/1826862035046728150 · Twitter Post