GitHub Advisoryadvisory · npm

GHSA-4w97-57v2-3w44 False-negative validation results in MINT transactions with invalid baton

CRITICAL Published 2020-05-12 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-11072
Ecosystem
npm
Packages
slp-validate
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-697
Reviewed
2020-05-12

Affected packages

• npm slp-validate: < 1.2.1 → fixed in 1.2.1

Description

Impact Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. Patches npm package slp-validate has been patched and published as version 1.2.1. Workarounds Upgrade to slp-validate 1.2.1. References • slp-validate commit For more information If you have any questions or comments about this advisory: • Open an issue in slp-validate

Related

Alias · CVE (1)

  • CVE-2020-11072 In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT… vulnerability

Weakness · CWE (1)

  • CWE-697 Incorrect Comparison weakness

References