| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| mppx | < 0.4.8 | 0.4.8 |
Multiple vulnerabilities were discovered in tempo/charge and tempo/session which allowed for undesirable behaviors, including:
tempo/charge transaction hashes across push/pull modes, across charge/session endpoints, and via concurrent requeststempo/charge requests due to missing transfer log verification in pull-modetempo/charge credentials across routes via cross-route scope confusion (memo/splits not included in scope binding)tempo/charge handler into paying for requests (missing sender signature before co-signing)tempo/session voucher signature verificationtempo/session channels via settle voucher reuse and weak channel ID bindingtempo/session requests by exploiting channel reopen without on-chain settled statetempo/session channelstempo/session channels via force-close detection bypass (closeRequestedAt not persisted)Fixed in 0.4.8.
There are no workarounds available for these vulnerabilities.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí