CVE-2020-11071 False-negative validation results in MINT transactions with invalid baton
A logic flaw in SLPJS allows false-negative validation of MINT transactions, potentially leading to the destruction of a user's minting baton.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11071?
CVE-2020-11071 is a high-severity vulnerability in simpleledger slpjs, published on 12 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This is fixed in version 0.27.2.
Weakness: CWE-697
Which versions are affected by CVE-2020-11071?
2 open source packages ship an affected version, including slpjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
slpjs npm | All versions | 0.27.2 |
slpjs npm | All versions | 0.27.2 |
Products include Simpleledger Slpjs.
How do I fix CVE-2020-11071?
Upgrade slpjs to 0.27.2 or later.
Is CVE-2020-11071 being exploited?
There is no known exploitation of CVE-2020-11071 in the wild and no public exploit code.
Other vulnerabilities in simpleledger slpjs
Sources
Also known as GHSA-jc83-cpf9-q7c6.