CVE-2023-39910 Weak cryptography in n/a
Weak entropy in Libbitcoin Explorer allows attackers to recover private keys and steal cryptocurrency funds from affected wallets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-39910?
CVE-2023-39910 is a high-severity vulnerability in n/a, published on 9 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023.
Weakness: CWE-338
Which versions are affected by CVE-2023-39910?
It affects 1 product.
Products include Libbitcoin Libbitcoin Explorer.
How do I fix CVE-2023-39910?
No fix has been published for CVE-2023-39910 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-39910 being exploited?
There is no known exploitation of CVE-2023-39910 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-prgj-h7jq-7p9h.