Use of GET Request Method With Sensitive Query Strings Affecting bitcoin/bitcoin package, versions [,0.21-final)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.04% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-BITCOINBITCOIN-8400320
  • published21 Nov 2024
  • disclosed18 Nov 2024
  • creditJohn Newbery

Introduced: 18 Nov 2024

CVE-2024-52913  (opens in a new tab)
CWE-598  (opens in a new tab)

How to fix?

Upgrade bitcoin/bitcoin to version 0.21-final or higher.

Overview

Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings due to mishandling of transaction re-requests. An attacker can prevent a node from seeing a specific unconfirmed transaction.

CVSS Scores

version 4.0
version 3.1