CVE-2023-39910

    Dashboard / Vulnerabilities / CVE-2023-39910

    CVE-2023-39910

    Published: 9 Aug 2023Last Modified: 12 Aug 2026

    Summary:

    Details: The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023.

    References: https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/commands/seed.cpp#L44, https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/utility.cpp#L78, https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910, https://github.com/libbitcoin/libbitcoin-system/blob/a1b777fc51d9c04e0c7a1dec5cc746b82a6afe64/src/crypto/pseudo_random.cpp#L66C12-L78, https://milksad.info/disclosure.html, https://news.ycombinator.com/item?id=37054862, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39910.json, https://nvd.nist.gov/vuln/detail/CVE-2023-39910

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 40887c2b7fa4565dad00fabe1f73899faacd12dc
    Fixed -68d2080b89e6a88974979fba13bc16f020f7be8e

    Affected versions

    v3.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39910 | CVE-DB