Lucene search

GitHub_MCVELIST:CVE-2020-11014

HistoryApr 28, 2020 - 8:10 p.m.

CVE-2020-11014 BIP LI01 output reordering may cause malformed SLP MINT transactions in Electron-Cash-SLP

2020-04-2820:10:13

GitHub_M

www.cve.org

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the “Mint Tool” feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the ability to issue new tokens or permanently destroy future minting capability. This is fixed version 3.6.2.

CNA Affected

[
  {
    "product": "Electron-Cash-SLP",
    "vendor": "simpleledger",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.6.2"
      }
    ]
  }
]

References

github.com/kristovatlas/rfc/blob/master/bips/bip-li01.mediawiki

github.com/simpleledger/Electron-Cash-SLP/commit/ea3912c3d508ba81b280ef7d78648464f7f76fb8

github.com/simpleledger/Electron-Cash-SLP/issues/126

github.com/simpleledger/Electron-Cash-SLP/security/advisories/GHSA-cchm-grx2-g873

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Related for CVELIST:CVE-2020-11014