NVD Vulnerability Detail

CVE-2020-11072

Summary	In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This has been fixed in slp-validate in version 1.2.1. Additonally, slpjs version 0.27.2 has a related fix under related CVE-2020-11071.
Publication Date	May 12, 2020, 10:15 a.m.
Registration Date	Jan. 26, 2021, 11:50 a.m.
Last Update	Nov. 21, 2024, 1:56 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:simpleledger:slp-validate::::::::					1.2.1

Related information, measures and tools

No	URL	タグ
1	https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7	Patch Third Party Advisory
2	https://github.com/simpleledger/slp-validate/security/advisories/GHSA-4w97-57v2-3w44	Third Party Advisory
3	https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7	Patch Third Party Advisory
4	https://github.com/simpleledger/slp-validate/security/advisories/GHSA-4w97-57v2-3w44	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-697	不適切な比較	https://cwe.mitre.org/data/definitions/697.html

JVN Vulnerability Information

SLP Validate における不適切な比較に関する脆弱性

Title	SLP Validate における不適切な比較に関する脆弱性
Summary	SLP Validate (npm package slp-validate) には、不適切な比較に関する脆弱性が存在します。本脆弱は、CVE-2020-11071 と関連する脆弱性です。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 29, 2020, midnight
Registration Date	June 17, 2020, 3:23 p.m.
Last Update	June 17, 2020, 3:23 p.m.

Affected System

Simple Ledger Protocol

slp-validate 1.2.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-11072	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11072
National Vulnerability Database (NVD)
2	CVE-2020-11072	https://nvd.nist.gov/vuln/detail/CVE-2020-11072

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-697	https://cwe.mitre.org/data/definitions/697.html

ベンダー情報

No	Name	URL
GitHub
1	False-negative validation results in MINT transactions with invalid baton	https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-4w97-57v2-3w44
2	fix false negative case for MINT transactions	https://github.com/simpleledger/slp-validate.js/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7

Change Log

No	Changed Details	Date of change
1	[2020年06月17日] 掲載	June 17, 2020, 3:23 p.m.