Monero: `set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITM

The setdaemon JSON-RPC in monero-wallet-rpc was found to have a vulnerability that silently ignored the sslallowedfingerprints parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all...

Monero: sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txset

The vulnerability in monero-wallet-rpc's signmultisig function allowed a malformed but decryptable multisig transaction set to cause a process crash instead of returning an error. The issue was resolved in version 0.18.5.0...