{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with code auditing by using a nonstandard line-break character for a comment. For example, a Move module author can enter the // sequence (which introduces a single-line comment), followed by very brief comment text, the \\r character, and code that has security-critical functionality. In many popular environments, this code is displayed on a separate line, and thus a reader may infer that the code is executed. However, the code is NOT executed, because language/compiler/ir_to_bytecode/src/parser.rs allows the comment to continue after the \\r character."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-09-11T03:51:57.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://blog.openzeppelin.com/libra-vulnerability-summary/"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.openzeppelin.com/libra-vulnerability-release/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/libra/libra/commit/7efb0221989f17fdf7f8486730898ed947a1e19e"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-16214", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with code auditing by using a nonstandard line-break character for a comment. For example, a Move module author can enter the // sequence (which introduces a single-line comment), followed by very brief comment text, the \\r character, and code that has security-critical functionality. In many popular environments, this code is displayed on a separate line, and thus a reader may infer that the code is executed. However, the code is NOT executed, because language/compiler/ir_to_bytecode/src/parser.rs allows the comment to continue after the \\r character."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://blog.openzeppelin.com/libra-vulnerability-summary/", "refsource": "MISC", "url": "https://blog.openzeppelin.com/libra-vulnerability-summary/"}, {"name": "https://blog.openzeppelin.com/libra-vulnerability-release/", "refsource": "MISC", "url": "https://blog.openzeppelin.com/libra-vulnerability-release/"}, {"name": "https://github.com/libra/libra/commit/7efb0221989f17fdf7f8486730898ed947a1e19e", "refsource": "MISC", "url": "https://github.com/libra/libra/commit/7efb0221989f17fdf7f8486730898ed947a1e19e"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:10:41.445Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.openzeppelin.com/libra-vulnerability-summary/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.openzeppelin.com/libra-vulnerability-release/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/libra/libra/commit/7efb0221989f17fdf7f8486730898ed947a1e19e"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-16214", "datePublished": "2019-09-11T03:51:57.000Z", "dateReserved": "2019-09-10T00:00:00.000Z", "dateUpdated": "2024-08-05T01:10:41.445Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libra:libra_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2E55F3B-1682-470D-83BA-9452A91FBF98", "versionEndExcluding": "2019-09-03", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with code auditing by using a nonstandard line-break character for a comment. For example, a Move module author can enter the // sequence (which introduces a single-line comment), followed by very brief comment text, the \\r character, and code that has security-critical functionality. In many popular environments, this code is displayed on a separate line, and thus a reader may infer that the code is executed. However, the code is NOT executed, because language/compiler/ir_to_bytecode/src/parser.rs allows the comment to continue after the \\r character."}, {"lang": "es", "value": "Libra Core antes del 03-09-2019, presenta una expresi\u00f3n regular err\u00f3nea para comentarios en l\u00ednea, lo que hace m\u00e1s f\u00e1cil para que atacantes interfieran con la auditoria del c\u00f3digo mediante el uso de un car\u00e1cter de salto de l\u00ednea no est\u00e1ndar para un comentario. Por ejemplo, un autor del m\u00f3dulo Move puede ingresar la secuencia // (que introduce un comentario de una sola l\u00ednea), seguido por un texto de comentario muy breve, el car\u00e1cter \\r y el c\u00f3digo que posee una funcionalidad cr\u00edtica para la seguridad. En muchos entornos populares, este c\u00f3digo es desplegado en una l\u00ednea separada y, por lo tanto, un lector puede inferir que el c\u00f3digo est\u00e1 ejecutado. Sin embargo, el c\u00f3digo NO se ejecuta, porque el archivo language/compiler/ir_to_bytecode/src/parser.rs permite que el comentario contin\u00fae despu\u00e9s del car\u00e1cter \\r."}], "id": "CVE-2019-16214", "lastModified": "2024-11-21T04:30:17.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-11T04:15:11.887", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://blog.openzeppelin.com/libra-vulnerability-release/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.openzeppelin.com/libra-vulnerability-summary/"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/libra/libra/commit/7efb0221989f17fdf7f8486730898ed947a1e19e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://blog.openzeppelin.com/libra-vulnerability-release/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.openzeppelin.com/libra-vulnerability-summary/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/libra/libra/commit/7efb0221989f17fdf7f8486730898ed947a1e19e"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}