CVE-2019-16761 Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0
An attacker can craft Bitcoin scripts to cause validation discrepancies, potentially leading to a hard fork in SLP consensus.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-16761?
CVE-2019-16761 is a medium-severity vulnerability in simpleledger slp-validate, published on 15 Nov 2019. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0.0 have been patched.
Weakness: CWE-20
Which versions are affected by CVE-2019-16761?
2 open source packages ship an affected version, including slp-validate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
slp-validate npm | From 1.0.0 | 1.0.1 |
slp-validate npm | From 1.0.0 | 1.0.1 |
Products include Simpleledger Slp-Validate.
How do I fix CVE-2019-16761?
Upgrade slp-validate to 1.0.1 or later.
Is CVE-2019-16761 being exploited?
There is no known exploitation of CVE-2019-16761 in the wild and no public exploit code.
Other vulnerabilities in simpleledger slp-validate
Sources
Also known as GHSA-wmx6-vxcf-c3gr.