A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus.
All versions > 0.21.3 are patched.
Upgrade to any version >= 0.21.4.
The bug was located and fixed here.
If you have any questions or comments about this advisory:
* Open an issue in the slpjs repo
* Email us at [email protected]
| Score | Percentile |
|---|---|
| 0.37% | 58.52% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 5.7 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-425c-ccf3-3jrr ↗ |
| CVE | CVE-2019-16762 ↗ |
| CWE id | Name |
|---|---|
| CWE-20 | Improper Input Validation |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | slpjs | < 0.21.4 | 0.21.4 | — |