CVE-2021-31876

Katalog CVE

CVSS 6.5 · Medium EPSS 1,6%

Kerentanan Incorrect Authorization pada bitcoin. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction with nSequence = 0xff_ff_ff_ff, spending an unconfirmed parent with nSequence <= 0xff_ff_ff_fd, should be replaceable because there is inherited signaling by the child transaction. However, the actual PreChecks implementation does not enforce this. Instead, mempool rejects the replacement attempt of the unconfirmed child transaction.

Rincian

Terbit di NVD

13 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bitcoinops.org/en/newsletters/2021/05/12/ advisory vendor
• https://bitcoinops.org/en/topics/replace-by-fee/ advisory vendor
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2021-31876 advisory pihak ketiga
• https://github.com/bitcoin/bitcoin advisory pihak ketiga
• https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2021-May/018893.html mailing list · advisory pihak ketiga