CVE-2011-4447
The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not properly interact with the deletion functionality of BSDDB, which allows context-dependent attackers to obtain unencrypted private keys from Bitcoin wallet…
Does this matter?
Lower severity and a low EPSS score (1.63%). Track it; it rarely justifies an emergency change on its own.
Description
The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not properly interact with the deletion functionality of BSDDB, which allows context-dependent attackers to obtain unencrypted private keys from Bitcoin wallet files by bypassing the BSDDB interface and reading entries that are marked for deletion.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.63% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- bitcoin/bitcoin core · bitcoin/wxbitcoin
- Source
- cve@mitre.org
References
- http://bitcoin.org/releases/2011/11/21/v0.5.0.html
- https://bitcointalk.org/index.php?topic=51474.0
- https://bitcointalk.org/index.php?topic=51604.0
- https://en.bitcoin.it/wiki/CVEsVendor Advisory
- http://bitcoin.org/releases/2011/11/21/v0.5.0.html
- https://bitcointalk.org/index.php?topic=51474.0
- https://bitcointalk.org/index.php?topic=51604.0
- https://en.bitcoin.it/wiki/CVEsVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.