CVE-2019-16753: High severity officialdapscoin decentralized anonymous payment system vulnerability

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. The reported impact is high confidentiality impact, with no integrity or availability impact listed.

Q: Which versions are known to be affected?

DAPS is reported as affected through 2019-08-26. PIVX Private Instant Verified Transactions is reported as affected through version 3.4.0.

Q: What is the practical signature risk?

Because signed content is formed from string representations rather than binary representations, a signature may be reusable in some cases. The issue can also allow a signature created for one message type to be reused for another message type.

Published Dec 4, 2019

Updated

An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak signature scheme design that would allow the reuse of signatures in some cases (or even the reuse of signatures, intended for one type of message, for another type). This also affects Private Instant Verified Transactions (PIVX) through 3.4.0.

Affected Software

2 affected components

Decentralized Anonymous Payment System Project Decentralized Anonymous Payment System<=2019-08-26

PIVX Private Instant Verified Transactions<=3.4.0

Event History

Dec 4, 2019

CVE Published

via MITRE·07:28 PM

Data Sourced

via MITRE·07:28 PM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. The reported impact is high confidentiality impact, with no integrity or availability impact listed.

Which versions are known to be affected?

DAPS is reported as affected through 2019-08-26. PIVX Private Instant Verified Transactions is reported as affected through version 3.4.0.

What is the practical signature risk?

Because signed content is formed from string representations rather than binary representations, a signature may be reusable in some cases. The issue can also allow a signature created for one message type to be reused for another message type.

CVE-2019-16753: High severity officialdapscoin decentralized anonymous payment system vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which versions are known to be affected?

What is the practical signature risk?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which versions are known to be affected?

What is the practical signature risk?