Improper input validation in Simpleledger Slp-Validate
CVE-2019-16761
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0.0 have been patched.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (61.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 61st percentile — 61.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Simpleledger Slp-Validate — versions 1.0.0
Weakness classification (CWE)
References
- github.com/simpleledger/slp-validate/security/advisories/GHSA-wmx6-vxcf-c3gr (Patch, Third Party Advisory)
- github.com/simpleledger/slp-validate/commit/50ad96c2798dad6b9f9a13333dd05232def… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-16761?
- CVE-2019-16761 is a medium-severity vulnerability in Simpleledger Slp-Validate, classified under Improper Input Validation. CVSS score: 5.7/10. Published 2019-11-15.
- How severe is CVE-2019-16761?
- Medium severity. CVSS v3 base score is 5.7 out of 10.