CVE-2011-4447 Information disclosure in n/a

Medium 4.3 Published 6 Aug 2012 Updated 17 Sep 2024

Attackers can recover unencrypted private keys from Bitcoin wallet files by reading deleted entries, bypassing encryption features.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2011-4447?

CVE-2011-4447 is a medium-severity vulnerability in Bitcoin Bitcoin Core, published on 6 Aug 2012. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not properly interact with the deletion functionality of BSDDB, which allows context-dependent attackers to obtain unencrypted private keys from Bitcoin wallet files by bypassing the BSDDB interface and reading entries that are marked for deletion.

Weakness: CWE-310

Which versions are affected by CVE-2011-4447?

It affects 2 products.

Products include Bitcoin Bitcoin Core, Bitcoin Wxbitcoin.

How do I fix CVE-2011-4447?

No fix has been published for CVE-2011-4447 yet. Limit exposure of the affected software until one is available.

Is CVE-2011-4447 being exploited?

There is no known exploitation of CVE-2011-4447 in the wild and no public exploit code.

All Bitcoin Bitcoin Core vulnerabilities

Sources

Also known as GHSA-3f65-5prq-693p.