Bsv Ruby Sdk
Approved changes feed: RSS · Atom
cpe:2.3:a:sgbett:bsv-ruby-sdk:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sgbett (ee7a9b63-825e-5d9d-8201-c959f8fe8811) |
|---|---|
| Product | Bsv Ruby Sdk (75e42e3a-dc34-5621-a7e3-5fef6bd685f9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-40070 |
vulnerable | 2026-06-08 08:01:19.852487 |
bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)
HIGH (8.1)
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.
Published: 2026-04-09T17:26:51.495Z
Updated: 2026-04-13T15:38:58.154Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40069 |
vulnerable | 2026-06-08 08:01:19.850802 |
bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts
HIGH (7.5)
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.
Published: 2026-04-09T17:22:28.416Z
Updated: 2026-04-13T20:11:51.134Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.