Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR3OTctNTd2Mi0zdzQ0

False-negative validation results in MINT transactions with invalid baton

Impact

Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

Patches

npm package slp-validate has been patched and published as version 1.2.1.

Workarounds

Upgrade to slp-validate 1.2.1.

References

slp-validate commit

For more information

If you have any questions or comments about this advisory:

Open an issue in slp-validate

Permalink: https://github.com/advisories/GHSA-4w97-57v2-3w44
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR3OTctNTd2Mi0zdzQ0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

CVSS Score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS Percentage: 0.00071
EPSS Percentile: 0.33514

Identifiers: GHSA-4w97-57v2-3w44, CVE-2020-11072
References:

Repository: https://github.com/simpleledger/slp-validate.js
Blast Radius: 8.2

Affected Packages

npm:slp-validate

Dependent packages: 1
Dependent repositories: 9
Downloads: 32 last month
Affected Version Ranges: < 1.2.1
Fixed in: 1.2.1
All affected versions: 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.1.3
All unaffected versions: 1.2.1, 1.2.2, 1.2.3