CVE-2019-16930

{"id": "CVE-2019-16930", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-09-28T22:15:09.857", "references": [{"url": "http://duke.leto.net/2019/10/01/zcash-metadata-leakage-cve-2019-16930.html", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/zcash/zcash/commit/c1fbf8ab5d73cff5e1f45236995857c75ba4128d", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/zcash/zcash/releases/tag/v2.0.7-3", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://z.cash/support/security/announcements/security-announcement-2019-09-24/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during deserialization of note plaintexts. This affects anyone who has disclosed their zaddr to a third party."}, {"lang": "es", "value": "Zcashd en Zcash versiones anteriores a 2.0.7-3, permite la detecci\u00f3n de la direcci\u00f3n IP de un nodo completo que posee una direcci\u00f3n blindada, relacionada con el manejo inapropiado de excepciones durante la deserializaci\u00f3n de textos planos de notas. Esto afecta a cualquiera que haya revelado su zaddr a un tercero."}], "lastModified": "2019-10-04T15:58:14.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:z.cash:zcash:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76AA1C9E-53CD-4B1A-B951-82F725553840", "versionEndExcluding": "2.0.7-3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}