Incorrect Account Used for Signing

Description

Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index 0), or with the legacy MEW/MyCrypto HD path, they are not affected.

Recommendation

Update the @metamask/eth-ledger-bridge-keyring package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.2
• Patched version(s): 0.2.2

References

• GHSA-vg44-fw64-cpjx
• www.npmjs.com
• snyk.io
• CWE-287
• OWASP 2021-A7

Related Issues

• PostCSS line return parsing error - CVE-2023-44270
• mavo DOM Clobbering vulnerability - CVE-2024-53388
• Cube API denial of service attack - CVE-2023-50709
• Prototype Pollution in protobufjs - CVE-2022-25878

Tags:

npm

@metamask/eth-ledger-bridge-keyring