CVE-2019-16214
- Source
- https://cve.org/CVERecord?id=CVE-2019-16214
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16214.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-16214
- Published
- 2019-09-11T04:15:11.887Z
- Modified
- 2026-07-08T05:55:17.374893435Z
- Severity
-
- 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with code auditing by using a nonstandard line-break character for a comment. For example, a Move module author can enter the // sequence (which introduces a single-line comment), followed by very brief comment text, the \r character, and code that has security-critical functionality. In many popular environments, this code is displayed on a separate line, and thus a reader may infer that the code is executed. However, the code is NOT executed, because language/compiler/irtobytecode/src/parser.rs allows the comment to continue after the \r character.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "fixed": "2019-09-03" } ], "source": "CPE_RANGE", "vendor_product": "libra:libra_core", "cpes": [ "cpe:2.3:a:libra:libra_core:*:*:*:*:*:*:*:*" ] }, { "extracted_events": [ { "fixed": "2019-09-03" } ], "source": "DESCRIPTION" } ] }- References