1 line
2.4 KiB
JSON
1 line
2.4 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0529","published":"2026-11-13T12:00:00Z","modified":"2026-11-13T12:45:06.795392066Z","aliases":["GHSA-mj2m-jxgv-r446"],"summary":"KVStoreInterpreter::verify_signature_legacy answers true for every token and every key","details":"`KVStoreInterpreter::verify_signature_legacy(&PushDrop, &PublicKey)`, public\nand deprecated since 0.2.0 (the crate's first release), read neither argument\nand answered `true`. A KVStore token signed by nobody, a signed token checked\nagainst a key other than its controller's, and a PushDrop with no fields each\npassed. Its documentation said it delegated to the `KVStoreFields`-based\nverifier; it did not.\n\nAn application that checks, with this function, a KVStore token it did not\nwrite (an overlay lookup's answer, or a transaction output a peer hands it) and\nacts on `true` accepts a value no controller signed, attributed to whatever\ncontroller the token names. No caller in the crate itself uses the function.\nThis was run on 0.2.0, 0.5.0, 0.8.0, 0.8.7, 0.8.8, 0.9.0-beta.1 and\n0.9.0-beta.7 as crates.io serves them, and the source of all 63 published\nversions carries the same constant body (the yanked 0.3.21 included).\n\n0.8.9 answers `true` only for a token whose controller field is the\ngiven key and whose last field is that key's signature over the others (the\n0.9 line's next prerelease carries the same fix). There is no workaround:\nupgrade to 0.8.9, or, on the 0.9 line, to its next prerelease.","affected":[{"package":{"name":"bsv-rs","ecosystem":"crates.io","purl":"pkg:cargo/bsv-rs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.8.9"},{"introduced":"0.9.0-beta.1"},{"fixed":"0.9.0-beta.7.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["bsv_rs::kvstore::KVStoreInterpreter::verify_signature_legacy"],"os":[]}},"database_specific":{"categories":["crypto-failure"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0529.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/bsv-rs"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0529.html"},{"type":"WEB","url":"https://github.com/Calhooon/bsv-rs/blob/v0.8.9/CHANGELOG.md"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]} |