CVE-2019-16762 Validator parsing discrepancy due to string encoding in NPM slpjs
Attackers can cause a hard-fork in SLP consensus by exploiting a parsing discrepancy in the slpjs library, affecting cryptocurrency applications.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-16762?
CVE-2019-16762 is a medium-severity vulnerability in simpleledger slpjs, published on 15 Nov 2019. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any version >= 0.21.4.
Weakness: CWE-20
Which versions are affected by CVE-2019-16762?
2 open source packages ship an affected version, including slpjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
slpjs npm | All versions | 0.21.4 |
slpjs npm | All versions | 0.21.4 |
Products include Simpleledger Slpjs.
How do I fix CVE-2019-16762?
Upgrade slpjs to 0.21.4 or later.
Is CVE-2019-16762 being exploited?
There is no known exploitation of CVE-2019-16762 in the wild and no public exploit code.
Other vulnerabilities in simpleledger slpjs
Sources
Also known as GHSA-425c-ccf3-3jrr.