Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZjZ2gtaGpwdy1xM2dx
Utils.readChallengeTx does not verify the server account signature
The Utils.readChallengeTx
function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the serverAccountID
has signed the transaction. The function does not verify that the server has signed the transaction and has been fixed so that it does in v8.2.3.
Applications that also used Utils.verifyChallengeTxThreshold
or Utils.verifyChallengeTxSigners
to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction.
Applications calling Utils.readChallengeTx
should update to v8.2.3 to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZjZ2gtaGpwdy1xM2dx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago
CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Identifiers: GHSA-6cgh-hjpw-q3gq, CVE-2021-32738
References:
- https://github.com/stellar/js-stellar-sdk/security/advisories/GHSA-6cgh-hjpw-q3gq
- https://github.com/stellar/js-stellar-sdk/commit/6f0bb889c2d10b431ddd5f4a1bcdd519c80430b3
- https://nvd.nist.gov/vuln/detail/CVE-2021-32738
- https://github.com/stellar/js-stellar-sdk/releases/tag/v8.2.3
- https://github.com/advisories/GHSA-6cgh-hjpw-q3gq
Blast Radius: 18.5
Affected Packages
npm:stellar-sdk
Dependent packages: 226Dependent repositories: 702
Downloads: 98,579 last month
Affected Version Ranges: < 8.2.3
Fixed in: 8.2.3
All affected versions: 0.1.9, 0.1.10, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10, 0.2.11, 0.2.12, 0.2.13, 0.2.14, 0.2.15, 0.2.16, 0.2.17, 0.2.18, 0.2.19, 0.2.20, 0.2.21, 0.2.22, 0.2.23, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.8.0, 0.8.1, 0.8.2, 0.9.1, 0.9.2, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.11.0, 0.12.0, 0.13.0, 0.14.0, 0.15.0, 0.15.1, 0.15.3, 0.15.4, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.3.0, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.3.0, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 6.0.0, 6.1.0, 6.2.0, 7.0.0, 8.0.0, 8.1.0, 8.1.1, 8.2.0, 8.2.1, 8.2.2
All unaffected versions: 8.2.3, 8.2.4, 8.2.5, 8.3.0, 9.0.0, 9.0.1, 9.1.0, 10.0.0, 10.0.1, 10.1.0, 10.1.1, 10.1.2, 10.2.0, 10.3.0, 10.4.0, 10.4.1, 11.0.0, 11.0.1, 11.1.0, 11.2.0, 11.2.1, 11.2.2, 11.3.0, 12.0.0