CVE-2019-16930

Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during deserialization of note plaintexts. This affects anyone who has disclosed their zaddr to a third party.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://duke.leto.net/2019/10/01/zcash-metadata-leakage-cve-2019-16930.html	Mitigation Third Party Advisory
https://github.com/zcash/zcash/commit/c1fbf8ab5d73cff5e1f45236995857c75ba4128d	Patch Third Party Advisory
https://github.com/zcash/zcash/releases/tag/v2.0.7-3	Third Party Advisory
https://z.cash/support/security/announcements/security-announcement-2019-09-24/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:z.cash:zcash:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-09-28 22:15

Updated : 2019-10-04 15:58

NVD link : CVE-2019-16930

Mitre link : CVE-2019-16930

CVE.ORG link : CVE-2019-16930

JSON object : View

Products Affected

z.cash

zcash

CWE

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2019-16930", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-09-28T22:15:09.857", "references": [{"url": "http://duke.leto.net/2019/10/01/zcash-metadata-leakage-cve-2019-16930.html", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/zcash/zcash/commit/c1fbf8ab5d73cff5e1f45236995857c75ba4128d", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/zcash/zcash/releases/tag/v2.0.7-3", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://z.cash/support/security/announcements/security-announcement-2019-09-24/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during deserialization of note plaintexts. This affects anyone who has disclosed their zaddr to a third party."}, {"lang": "es", "value": "Zcashd en Zcash versiones anteriores a 2.0.7-3, permite la detecci\u00f3n de la direcci\u00f3n IP de un nodo completo que posee una direcci\u00f3n blindada, relacionada con el manejo inapropiado de excepciones durante la deserializaci\u00f3n de textos planos de notas. Esto afecta a cualquiera que haya revelado su zaddr a un tercero."}], "lastModified": "2019-10-04T15:58:14.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:z.cash:zcash:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76AA1C9E-53CD-4B1A-B951-82F725553840", "versionEndExcluding": "2.0.7-3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}