Security· ★★· neutral·

MentisDB patches flaw letting scoped tokens reach other chains

  • —Versions up to 0.10.8.53 were affected when bearer auth was enabled
  • —A chain-scoped token could read, modify and delete other chains
  • —Peak memory in the test fell from over 6 GB to about 1.7 GB
  • —The release also fixes a stored XSS in the dashboard and adds CSRF protections
Why it matters: The flaw exposed administrative-level operations, so operators using bearer tokens should update immediately.
Source: DiarioBitcoin
More on this
Security · Oct 12
LDK patches Lightning flaw that let peers steal forwarded Bitcoin via reconnect lie
 Security · Sep 30
Apple Patches iOS Flaw That Could Let Attackers Run Malicious Code on iPhones
 Security · Sep 28
Core Lightning patches flaw letting revoked channel states escape penalty