Is CVE-2020-11072 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-11072 being exploited in the wild.

How severe is CVE-2020-11072?

Low severity, with a CVSS score of 3.1, published 12 May 2020.

Which products and versions are affected?

slp-validate (npm) SEMVER:introduced=0,fixed=1.2.1.

Is there a fix for CVE-2020-11072?

Yes. slp-validate (npm): upgrade to 1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-11072 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-11072?

Check whether you run slp-validate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-11072: Simple Ledger Protocol slp-validate false-negative validation in MINT transactions

CVE-2020-11072 · Severity: low · CVSS 3.1 · Published 2020-05-12

The slp-validate library is used to validate Simple Ledger Protocol (SLP) cryptocurrency transactions. A validation defect causes MINT transactions with invalid batons to incorrectly pass validation checks. This could allow a poorly implemented wallet to spend affected tokens, destroying a user's minting baton and resulting in permanent loss of the ability to create new tokens.

Technologies: slp-validate (npm). Vendors: npm.

Quick answers

Is CVE-2020-11072 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-11072 being exploited in the wild.
How severe is CVE-2020-11072?: Low severity, with a CVSS score of 3.1, published 12 May 2020.
Which products and versions are affected?: slp-validate (npm) SEMVER:introduced=0,fixed=1.2.1.
Is there a fix for CVE-2020-11072?: Yes. slp-validate (npm): upgrade to 1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-11072 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-11072?: Check whether you run slp-validate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

slp-validate (npm): upgrade to 1.2.1 or later
```
npm install slp-validate@1.2.1
```

Technical details

The vulnerability is an improper input validation (CWE-697) issue in the slp-validate validation logic for MINT transaction operations. The validator fails to reject MINT transactions containing invalid batons, resulting in false-negative validation outcomes. When a wallet relies on this flawed validation, it may accept and process a MINT transaction that should have been rejected, allowing an attacker to spend tokens associated with the minting baton and permanently destroy that baton. The affected component is the MINT transaction validation routine. The vulnerability requires no authentication and is reachable over the network if the vulnerable library is used in a wallet or service. The patch was released in version 1.2.1, fixing the validation logic to properly reject invalid batons in MINT transactions.

Affected products

Simple Ledger slp-validate <1.2.1

Identifiers

CVE-2020-11072
GHSA-4w97-57v2-3w44

Timeline

2020-05-12: disclosed
2020-05-12: patched: Version 1.2.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.