| Package | Affected versions | Patched versions |
|---|---|---|
| mppx | < 0.4.8 | 0.4.8 |
Multiple vulnerabilities were discovered in tempo/charge and tempo/session which allowed for undesirable behaviors, including:
tempo/charge transaction hashes across push/pull modes, across charge/session endpoints, and via concurrent requeststempo/charge requests due to missing transfer log verification in pull-modetempo/charge credentials across routes via cross-route scope confusion (memo/splits not included in scope binding)tempo/charge handler into paying for requests (missing sender signature before co-signing)tempo/session voucher signature verificationtempo/session channels via settle voucher reuse and weak channel ID bindingtempo/session requests by exploiting channel reopen without on-chain settled statetempo/session channelstempo/session channels via force-close detection bypass (closeRequestedAt not persisted)Fixed in 0.4.8.
There are no workarounds available for these vulnerabilities.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free