{"answers":{"affected":"4 open source packages ship an affected version, including hd-wallet and slip-10.","exploited":"There is no known exploitation of GHSA-2ff4-xfpr-m32r in the wild and no public exploit code.","fix":"Upgrade hd-wallet to 0.6.0 or later.","what":"GHSA-2ff4-xfpr-m32r is a denial of service vulnerability in hd-wallet, published on 18 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-2ff4-xfpr-m32r and fix it if it is affected.\n\nWhat it is: GHSA-2ff4-xfpr-m32r is a denial of service vulnerability in hd-wallet, published on 18 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-2ff4-xfpr-m32r in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- hd-wallet (crates.io): affected all versions; fixed in 0.6.0\n- hd-wallet (crates.io): affected all versions; fixed in 0.6.0\n- slip-10 (crates.io): affected all versions up to 0.4.1; no fix listed\n- slip-10 (crates.io): affected all versions up to 0.4.1; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-2ff4-xfpr-m32r/ (Markdown: https://insights.sbomify.com/GHSA-2ff4-xfpr-m32r/index.md)","id":"GHSA-2ff4-xfpr-m32r","markdown":"https://insights.sbomify.com/GHSA-2ff4-xfpr-m32r/index.md","name":"GHSA-2ff4-xfpr-m32r","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Rust HD wallet library","requires_auth":"none","summary":"Attacker can cause denial of service in Rust HD wallet libraries by forcing infinite loops when using non-standard elliptic curves.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\u003c!-- _What kind of vulnerability is it? Who is impacted?_ --\u003e\n\n**Impacted are the only ones who use [`hd_wallet::Slip10Like`](https://docs.rs/hd-wallet/0.5.1/hd_wallet/struct.Slip10Like.html) or [`slip_10`](https://docs.rs/slip-10/latest/slip_10/) derivation method instantiated with curves other than secp256k1 and secp256r1.**\n\n`hd_wallet` crate used to provide `Slip10Like` derivation method, which is also provided in `slip-10` crate as a default derivation method. It's based on [slip10](https://github.com/satoshilabs/slips/blob/master/slip-0010.md) method that searches for a valid child key in an infinite loop until it's found.\n\nTheoretically, this could be exploited by an attacker by finding a derivation path that would force someone to execute a lot of iterations of this loop to find a valid child key. This attack, however, requires the probability of getting an invalid scalar from random 32 bytes to be high. Slip10 is protected from this attack as it's only defined on secp256k1 and secp256r1 curves, for which such probability is very low:\n\n- For secp256k1, probability is $\u003c 2^{-127}$. This means that a loop with 2 or more iterations is vanishingly impossible.\n- For secp256r1, probability is $\u003c 2^{-32}$. This means that a loop with 5 or more iterations is vanishingly impossible.\n\nWhile standard curves are safe to use with slip10, we used to allow slip10-like derivation which can be instantiated with any curve. For instance, one could instantiate it with ed25519 or stark curves, for which probability of getting invalid scalar from random 32 bytes is \u003e90%, so theoretically, attacker could try to DoS such construction.\n\n### Patches\n\u003c!-- _Has the problem been patched? What versions should users upgrade to?_ --\u003e\n\n`hd_wallet v0.6.0` has been patched by removing slip10-like derivation from public API.\n\nIf you need HD derivation on other curves than secp256k1 and secp256r1, we suggest you to use:\n* [`hd_wallet::Edwards`](https://docs.rs/hd-wallet/latest/hd_wallet/edwards/struct.Edwards.html) derivation method available for ed25519 curve\n* [`hd_wallet::Stark`](https://docs.rs/hd-wallet/latest/hd_wallet/stark/struct.Stark.html) derivation method available for stark curve\n\nBoth derivation methods are non-standard, but secure and efficient.\n\n**If you're still using `slip_10`** and would like to migrate to patched version, please migrate to `hd_wallet v0.6`. You may first migrate from `slip_10 v0.4` to `hd_wallet v0.5` by following migration instructions available [in the docs](https://docs.rs/slip-10/latest/slip_10/), and then upgrade from `hd_wallet v0.5` to `hd_wallet v0.6`.\n\n### Workarounds\nTechnically, you don't need to upgrade if you don't use slip10-like derivation instantiated with other curves than secp256k1 or secp256r1.\n\nHowever, if you do, migrating to other derivation method might be required.\n\n### Reach out to us in Discord\n\nIf you want to reach out to us, feel free to write to [`#lockness` room in Discord](https://discordapp.com/channels/905194001349627914/1294284489635139585)\n\n### Credits\n\nThanks to Alessio Marziali \u003calessio.marziali@metaco.com\u003e for discovering and flagging this issue","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Impact \u003c!-- _What kind of vulnerability is it?","id":"GHSA-2ff4-xfpr-m32r","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2024"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.6.0"],"introduced":["0"],"last_affected":[],"package":"hd-wallet","purl":null,"source":"GHSA-2ff4-xfpr-m32r"},{"ecosystem":"crates.io","fixed":["0.6.0"],"introduced":["0"],"last_affected":[],"package":"hd-wallet","purl":"pkg:cargo/hd-wallet","source":"GHSA-2ff4-xfpr-m32r"},{"ecosystem":"crates.io","fixed":[],"introduced":["0"],"last_affected":["0.4.1"],"package":"slip-10","purl":null,"source":"GHSA-2ff4-xfpr-m32r"},{"ecosystem":"crates.io","fixed":[],"introduced":["0"],"last_affected":["0.4.1"],"package":"slip-10","purl":"pkg:cargo/slip-10","source":"GHSA-2ff4-xfpr-m32r"}],"products":null,"published":"2024-12-18","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attacker can cause denial of service in Rust HD wallet libraries by forcing infinite loops when using non-standard elliptic curves.","url":"https://insights.sbomify.com/GHSA-2ff4-xfpr-m32r/"}