GHSA-8F9F-PC5V-9R5H高危已审查

Malicious takeover of previously owned ENS names

OSV 1.4.0 · github-reviewed · 修改于 2022-09-22 03:32

发布时间

2020-01-31 07:55

GitHub 审查时间

2020-01-31 07:54

NVD 发布时间

2020-01-31 08:15

源文件

advisories/github-reviewed/2020/01/GHSA-8f9f-pc5v-9r5h/GHSA-8f9f-pc5v-9r5h.json

公告说明

Impact

A user who owns an ENS domain can set a "trapdoor", allowing them to transfer ownership to another user, and later regain ownership without the new owner's consent or awareness.

Patches

A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry. The registry is newly deployed at 0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e.

Workarounds

Do not accept transfers of ENS domains from other users on the old registrar.

受影响的软件包

npm

@ensdomains/ens

ECOSYSTEM

标识信息

别名 / CVE

CVE-2020-5232

CWE

CWE-285

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

原始 OSV JSON

{
  "id": "GHSA-8f9f-pc5v-9r5h",
  "aliases": [
    "CVE-2020-5232"
  ],
  "details": "### Impact\nA user who owns an ENS domain can set a \"trapdoor\", allowing them to transfer ownership to another user, and later regain ownership without the new owner's consent or awareness.\n\n### Patches\n\nA new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry. The registry is newly deployed at [0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e](https://etherscan.io/address/0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e).\n\n### Workarounds\nDo not accept transfers of ENS domains from other users on the old registrar.",
  "summary": "Malicious takeover of previously owned ENS names",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ]
        }
      ],
      "package": {
        "name": "@ensdomains/ens",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2022-09-21T19:32:10Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
    }
  ],
  "published": "2020-01-30T23:55:04Z",
  "references": [
    {
      "url": "https://github.com/ensdomains/ens/security/advisories/GHSA-8f9f-pc5v-9r5h",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5232",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/ensdomains/ens/commit/36e10e71fcddcade88646821e0a57cc6c19e1ecf",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2020-01-31T00:15:00Z",
    "github_reviewed_at": "2020-01-30T23:54:51Z"
  }
}