- Reported
-
- Issued
-
- Package
-
bsv-rs
(crates.io)
- Type
-
Vulnerability
- Keywords
-
#bitcoin
#transaction
#txid
#json
#parsing
#input-validation
- Aliases
-
- References
-
- CVSS Score
- 5.3
MEDIUM
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- Low
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Patched
-
>=0.8.6, <0.9.0-beta.1>0.9.0-beta.7
- Affected Functions
- Version
bsv_rs::transaction::Transaction::from_json-
<0.8.6>=0.9.0-beta.1, <=0.9.0-beta.7
Description
Transaction::from_json, for a document with no hex member, held each
input's txid member as given. An input txid that is not 64 hex digits
("zz", "", 63 or 65 digits, characters that are not hex digits) answered
Ok: source_txid and to_json gave the text back, while to_binary wrote
the input as spending the txid of 32 zero bytes and id() hashed those bytes.
Documents naming different texts were one transaction, spending an outpoint
none of them named.
An application that reads a peer's transaction document with from_json and
relies both on the text of its inputs and on its bytes or id() is affected;
one that reads only documents it produced is not.
0.8.6 refuses such a txid (Invalid txid of input N: expected 64 hex digits).
Where upgrading is not possible, require each input's txid to be 64 ASCII hex
digits before calling from_json.
Advisory available under CC0-1.0
license.