Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@metamask/eth-ledger-bridge-keyring

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Incorrect Account Used for Signing

    GHSA-vg44-fw64-cpjx

    Affected
    • npm @metamask/eth-ledger-bridge-keyring < 0.2.2
    Fixed in
    0.2.2· Vendor fix available
    Issue
    Impact Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index 0), or with the legacy MEW/MyCrypto HD path, they are not affected. The vulnerability impacts cases where the user signs a personal message or transaction without first adding the account. This includes cases where the user has already added the account in a previous session (i.e. they added the account, reset the application, then signed something). The serialization/deserialization process does restore a previously added account, but it doesn&#39;t restore the index instructing the keyring to use that account for signing. As a result, after serializing then deserializing the keyring state, the account at index 0 is always used for signing even if it isn&#39;t the current account. Patches This has been patched (#14) in version &gt;=0.2.1 of eth-ledger-bridge-keyring, and in version &gt;=0.2.2 of…

    Recommended action: Upgrade to 0.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →