GCVE - cpe:2.3:a:libbitcoin:libbitcoin

Approved changes feed: RSS · Atom

cpe:2.3:a:libbitcoin:libbitcoin_explorer:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Libbitcoin (`bcb41bd1-449c-59d5-9994-2f8f8f918c6c`)
Product	Libbitcoin Explorer (`19601f82-987a-5cb3-94c6-c2dd04adc1f9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:github/libbitcoin/libbitcoin-explorer`	purl2cpe	2026-06-01 10:11:29.558240

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-39910`	vulnerable	2026-06-08 06:09:38.078891	Details available The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023. Published: 2023-08-09T00:00:00.000Z Updated: 2024-10-10T18:10:09.061Z Open on db.gcve.eu Reference links https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/commands/seed.cpp#L44 https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/utility.cpp#L78 https://github.com/libbitcoin/libbitcoin-system/blob/a1b777fc51d9c04e0c7a1dec5cc746b82a6afe64/src/crypto/pseudo_random.cpp#L66C12-L78 https://milksad.info/disclosure.html https://news.ycombinator.com/item?id=37054862	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.