7.5
CVE-2017-12842
- EPSS 2.16%
- Veröffentlicht 16.03.2020 20:15:12
- Zuletzt bearbeitet 21.11.2024 03:10:17
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginBitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would cost more than a million dollars, and is relevant mainly only in situations where an autonomous system relies solely on an SPV proof for transactions of a greater dollar amount.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bitcoin ≫ Bitcoin Core Version < 0.14.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.16% | 0.799 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures
https://bitslog.wordpress.com/2018/06/09/leaf-node-weakness-in-bitcoin-merkle-tree-design/
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-February/016697.html