CVE-2019-16762

low-risk
Published 2019-11-15

A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any version >= 0.21.4.

Do I need to act?

-
0.37% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.7/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Slpjs

Affected Vendors

Simpleledger

References (4)

Patch https://github.com/simpleledger/slpjs/commit/ac8809b42e47790a6f0205991b36f2699ed...
Exploit https://github.com/simpleledger/slpjs/security/advisories/GHSA-425c-ccf3-3jrr
Patch https://github.com/simpleledger/slpjs/commit/ac8809b42e47790a6f0205991b36f2699ed...
Exploit https://github.com/simpleledger/slpjs/security/advisories/GHSA-425c-ccf3-3jrr
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal