Threat Investigation
Request a demo

CVE-2019-16762

Medium

Description

A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any version >= 0.21.4.

SeverityMedium
CVSS5.7
Exploit probability—
ProductSimpleledger Slpjs
PublishedNov 15, 2019
First seenNov 15, 2019
Weakness typeCWE-20Improper input validation

How to fix

Update
  • simpleledger slpjs0.21.4 or later
  • slpjs0.21.4 or later

Affected products

ProductAffected versionsFixed in
simpleledger slpjsv < 0.21.40.21.4
slpjsnpmv < 0.21.40.21.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.