CVE-2018-17145: Bitcoin Inventory Out-of-Memory Denial-of-Service Attack
Summary
CVE-2018-17145: Bitcoin Inventory Out-of-Memory Denial-of-Service Attack (CVE-2018-17145). Affects bcoin versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'bcoin' package is an npm package that provides an implementation of the Bitcoin protocol. It is used to create and manage Bitcoin wallets, perform transactions, and interact with the Bitcoin network. The package is widely used in various Bitcoin-related applications and services.
Vulnerability Detail
The 'bcoin' package was found to have an uncontrolled memory resource consumption denial-of-service vulnerability in its peer-to-peer network code. This vulnerability, identified as CVE-2018-17145, could be easily exploited by an attacker. By exploiting this vulnerability, an attacker could cause the affected Bitcoin implementation to consume excessive memory resources, leading to a denial-of-service condition. This vulnerability affects multiple implementations of Bitcoin and several alternative chains.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
npm install bcoin@1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the 'bcoin' package to the fixed version to mitigate the risk of a denial-of-service attack.
Conclusion
The 'bcoin' package is vulnerable to an uncontrolled memory resource consumption denial-of-service attack. To mitigate this vulnerability, it is crucial to update the package to version 1.0.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bcoin →
FAQ
This vulnerability can be exploited by an attacker to cause a denial-of-service condition in the affected Bitcoin implementation, leading to service disruption.
Versions prior to 1.0.2 of the 'bcoin' package are affected by this vulnerability.
There have been reports of this vulnerability being actively exploited in the wild. It is crucial to update the 'bcoin' package to the fixed version to protect against potential attacks.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
You can find more information about this vulnerability in the official CVE-2018-17145 advisory and the associated research paper linked in the vulnerability details.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.