Lucene search

GoogleOSV:CVE-2022-40769

HistorySep 18, 2022 - 5:15 p.m.

CVE-2022-40769

2022-09-1817:15:09

Google

osv.dev

cve-2022-40769

profanity

rng

ethereum

cryptocurrency

vulnerability

exploited

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.3%

JSON

profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cryptocurrency, as exploited in the wild in June 2022.

CPENameOperatorVersion
profanityeq1.11
profanityeq1.1
profanityeq1.3
profanityeq1.60
profanityeq1.12
profanityeq1.21
profanityeq1.22
profanityeq1.2
profanityeq1.31
profanityeq1.50

Name	Operator	Version
profanity	eq	1.11
profanity	eq	1.1
profanity	eq	1.3
profanity	eq	1.60
profanity	eq	1.12
profanity	eq	1.21
profanity	eq	1.22
profanity	eq	1.2
profanity	eq	1.31
profanity	eq	1.50

Rows per page:

1-10 of 121

References

blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c

github.com/johguse/profanity

github.com/johguse/profanity/issues/61

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.3%

JSON

Related for OSV:CVE-2022-40769