Incorrect Account Used for Signing

Description

Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index 0), or with the legacy MEW/MyCrypto HD path, they are not affected.

Recommendation

Update the @metamask/eth-ledger-bridge-keyring package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.2
• Patched version(s): 0.2.2

References

• GHSA-vg44-fw64-cpjx
• www.npmjs.com
• snyk.io
• CWE-287
• OWASP 2021-A7

Related Issues

• Incorrect version tags linked to external repository - Vulnerability
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) - Vulnerability
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

@metamask/eth-ledger-bridge-keyring