- Reported
-
- Issued
-
- Package
-
bsv-rs
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#bitcoin
#beef
#spv
#verification
- Aliases
-
- References
-
- CVSS Score
- 7.5
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- High
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Patched
-
>=0.8.5, <0.9.0-beta.1>0.9.0-beta.7
- Affected Functions
- Version
bsv_rs::transaction::Beef::find_atomic_transaction-
<0.8.5>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::transaction::Beef::find_transaction_for_signing-
<0.8.5>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::transaction::Beef::is_valid-
<0.8.5>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::transaction::Beef::merge_raw_tx-
<0.8.5>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::transaction::Beef::sort_txs-
<0.8.5>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::transaction::Beef::verify_structure-
>=0.4.2, <0.8.5>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::transaction::Beef::verify_valid-
<0.8.5>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::transaction::BeefTx::from_raw_tx-
<0.8.5>=0.9.0-beta.1, <=0.9.0-beta.7
Description
Beef::merge_raw_tx and BeefTx::from_raw_tx accept raw bytes without a
Result. For bytes that are not exactly one transaction (a transaction
followed by bytes, a cut transaction, bytes that are no transaction at all),
Beef::sort_txs, verify_structure, verify_valid and is_valid could
answer valid, even with no BUMP and no parent in the BEEF, and, where the entry
carried a BUMP index, treat the hash of those bytes as a proven transaction id;
an entry that names it as a parent was answered valid too.
The wire readers (Beef::from_binary, verify_stream,
Transaction::from_beef, from_atomic_beef) parse every entry and are not
affected. Reaching this needs an application that passes bytes it did not
parse to merge_raw_tx or BeefTx::from_raw_tx and then relies on the verdict
or on the transaction the BEEF hands back.
0.8.5 refuses such an entry at all four verdict doors, with or without a BUMP
index, and every entry that names it as a parent. Where upgrading is not
possible, do not rely on is_valid or verify_valid alone for such an entry:
check that the bytes are exactly one transaction before merging them.
Advisory available under CC0-1.0
license.