CVE-2020-12119

Description

Ledger Live before 2.7.0 does not handle Bitcoins Replace-By-Fee (RBF). It increases the users balance with the value of an unconfirmed transaction as soon as it is received (before the transaction is confirmed) and does not decrease the balance when it is canceled. As a result, users are exposed to basic double spending attacks, amplified double spending attacks, and DoS attacks without user consent.

Risk Information

Base Score

8.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS Score

Exploitation Probability

0.2

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-12119 are affected in Ledger Live (x64) 2.6.9	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234