False-negative validation results in MINT transactions with invalid baton

高 8.6CVE-2020-11072 · GHSA-4w97-57v2-3w44 · 12/05/2020 公開 · 17/06/2026 更新

要点

CVE-2020-11072 は slp-validate (simpleledger), slp-validate に影響する深刻度「高」 (CVSS 8.6) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 64.0% より高い）。
対処：1.2.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
slp-validate simpleledger	`< 1.2.1`	`1.2.1`
slp-validate npm	`< 1.2.1`	`1.2.1`

概要

Impact

Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

Patches

npm package slp-validate has been patched and published as version 1.2.1.

Workarounds

Upgrade to slp-validate 1.2.1.

References

slp-validate commit

For more information

If you have any questions or comments about this advisory:

Open an issue in slp-validate

NVD の説明

In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This has been fixed in slp-validate in version 1.2.1. Additonally, slpjs version 0.27.2 has a related fix under related CVE-2020-11071.