Lucene search

MitreCVE-2019-16753

HistoryDec 04, 2019 - 8:15 p.m.

CVE-2019-16753

2019-12-0420:15:12

CWE-347

mitre

web.nvd.nist.gov

cve-2019-16753

information security

daps

pivx

weak signature scheme

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.006

Percentile

78.6%

JSON

An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak signature scheme design that would allow the reuse of signatures in some cases (or even the reuse of signatures, intended for one type of message, for another type). This also affects Private Instant Verified Transactions (PIVX) through 3.4.0.

Affected configurations

Nvd

Node

decentralized_anonymous_payment_system_projectdecentralized_anonymous_payment_systemRange≤2019-08-26

pivxprivate_instant_verified_transactionsRange≤3.4.0

VendorProductVersionCPE
decentralized_anonymous_payment_system_projectdecentralized_anonymous_payment_system*cpe:2.3:a:decentralized_anonymous_payment_system_project:decentralized_anonymous_payment_system:*:*:*:*:*:*:*:*
pivxprivate_instant_verified_transactions*cpe:2.3:a:pivx:private_instant_verified_transactions:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
decentralized_anonymous_payment_system_project	decentralized_anonymous_payment_system	*	cpe:2.3:a:decentralized_anonymous_payment_system_project:decentralized_anonymous_payment_system::::::::
pivx	private_instant_verified_transactions	*	cpe:2.3:a:pivx:private_instant_verified_transactions::::::::

References

officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.006

Percentile

78.6%

JSON

Related for CVE-2019-16753