CVE-2021-32738

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-32738
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-32738.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-32738
Aliases
Related
Published
2021-07-02T19:15:08.063Z
Modified
2026-03-13T04:54:33.703692Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the serverAccountID has signed the transaction. In js-stellar-sdk before version 8.2.3, the function does not verify that the server has signed the transaction. Applications that also used Utils.verifyChallengeTxThreshold or Utils.verifyChallengeTxSigners to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction. Applications calling Utils.readChallengeTx should update to version 8.2.3, the first version with a patch for this vulnerability, to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.

References

Affected packages

Git / github.com/stellar/js-stellar-sdk

Affected ranges

Type
GIT
Repo
https://github.com/stellar/js-stellar-sdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6f0bb889c2d10b431ddd5f4a1bcdd519c80430b3
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.2.3"
        }
    ]
}

Affected versions

v0.*
v0.1.10
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.15.4
v0.2.0
v0.2.1
v0.2.10
v0.2.11
v0.2.12
v0.2.13
v0.2.14
v0.2.15
v0.2.16
v0.2.17
v0.2.18
v0.2.19
v0.2.2
v0.2.20
v0.2.21
v0.2.22
v0.2.23
v0.2.3
v0.2.4
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.9.1
v0.9.2
v1.*
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v2.*
v2.0.1
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v3.*
v3.0.0
v3.0.1
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.3.0
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.1.0
v5.*
v5.0.0
v5.0.0-alpha.1
v5.0.0-alpha.2
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v6.*
v6.0.0
v6.1.0
v6.2.0
v7.*
v7.0.0
v8.*
v8.0.0
v8.1.0
v8.1.1
v8.2.0
v8.2.1
v8.2.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-32738.json"