GHSA-6cgh-hjpw-q3gq

Source

https://github.com/advisories/GHSA-6cgh-hjpw-q3gq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-6cgh-hjpw-q3gq/GHSA-6cgh-hjpw-q3gq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6cgh-hjpw-q3gq

Aliases

CVE-2021-32738

Published

2021-07-02T19:20:33Z

Modified

2026-07-08T06:29:28Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Utils.readChallengeTx does not verify the server account signature

Details

The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the serverAccountID has signed the transaction. The function does not verify that the server has signed the transaction and has been fixed so that it does in v8.2.3.

Applications that also used Utils.verifyChallengeTxThreshold or Utils.verifyChallengeTxSigners to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction.

Applications calling Utils.readChallengeTx should update to v8.2.3 to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.

Database specific

{
    "cwe_ids":  [
        "CWE-287",
        "CWE-347"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-07-02T18:25:08Z",
    "nvd_published_at":  "2021-07-02T19:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / stellar-sdk

Package

Name: stellar-sdk; View open source insights on deps.dev
Purl: pkg:npm/stellar-sdk

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.2.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-6cgh-hjpw-q3gq/GHSA-6cgh-hjpw-q3gq.json"