GitHub Advisoryadvisory · npm

GHSA-425c-ccf3-3jrr Critical severity vulnerability that affects slpjs

CRITICAL Published 2019-11-15 Modified 2021-01-08 Official page ↗
Aliases
CVE-2019-16762
Ecosystem
npm
Packages
slpjs
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• npm slpjs: < 0.21.4 → fixed in 0.21.4

Description

Validator parsing discrepancy due to string encoding Impact A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Patches All versions > 0.21.3 are patched. Workarounds Upgrade to any version >= 0.21.4. References The bug was located and fixed here. For more information If you have any questions or comments about this advisory: • Open an issue in the slpjs repo • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2019-16762 A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References