Description
Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index 0), or with the legacy MEW/MyCrypto HD path, they are not affected.
Recommendation
Update the eth-ledger-bridge-keyring package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.2.1
- Patched version(s): 0.2.1
References
Could your website be exposed too?
SmartScanner can check your website for Incorrect Account Used for Signing - eth-ledger-bridge-keyring and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Incorrect Account Used for Signing - Vulnerability
- @saltcorn/data: Tenant user role is used for tenant creation role check - Vulnerability
- Incorrect default cookie name and recommendation - Vulnerability
- MCP Connect has unauthenticated remote OS command execution via /bridge endpoint - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023