Description
Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index 0), or with the legacy MEW/MyCrypto HD path, they are not affected.
Recommendation
Update the @metamask/eth-ledger-bridge-keyring package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.2.2
- Patched version(s): 0.2.2
References
Could your website be exposed too?
SmartScanner can check your website for Incorrect Account Used for Signing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Incorrect Account Used for Signing - eth-ledger-bridge-keyring - Vulnerability
- @saltcorn/data: Tenant user role is used for tenant creation role check - Vulnerability
- Incorrect default cookie name and recommendation - Vulnerability
- CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection - CVE-2024-24815
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023