Incorrect Account Used for Signing - eth-ledger-bridge-keyring

Description

Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index 0), or with the legacy MEW/MyCrypto HD path, they are not affected.

Recommendation

Update the eth-ledger-bridge-keyring package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.1
• Patched version(s): 0.2.1

References

• GHSA-vg44-fw64-cpjx
• www.npmjs.com
• snyk.io
• CWE-287
• OWASP 2021-A7

Related Issues

• Incorrect Account Used for Signing - Vulnerability
• @saltcorn/data: Tenant user role is used for tenant creation role check - Vulnerability
• Incorrect default cookie name and recommendation - Vulnerability
• MCP Connect has unauthenticated remote OS command execution via /bridge endpoint - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

eth-ledger-bridge-keyring