CVE-2020-14199

Advisory

Cryptoadvance.specter 0.5.0 updates its dependency 'hwi' to v1.1.2 to include a security fix.
https://github.com/cryptoadvance/specter-desktop/pull/178
https://github.com/cryptoadvance/specter-desktop/issues/150

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Bugfix: Fix compatibility issue with latest Ledger and Trezor firmwares (addresses new BIP143 vulnerability), use HWI 1.1.2 (178) (stepansnigirev)
- Bugfix: Don't update explorer if chain is unknown (174) (stepansnigirev)
- Bugfix: Fix labels issue with Bitcoin Core v0.20.0 (160) (benk10)
- Feature: Multi-user support (172) (benk10)
- Feature: Import-export PSBT transactions (175) (stepansnigirev)
- Feature: Support HWI display multisig address on device (ColdCard, KeepKey, Trezor) (179) (benk10)
- UI: Show installed Specter version and notify on upgrades on the Setting page. (158) (k9ert)
- UI: Redesign and improve notifications and error messages (177, 163) (stepansnigirev)
- UI: Separate the different areas in the Settings screen into tabs. (176) (benk10)
- UI: Add copy button for QR codes (173) (stepansnigirev)
- UI: Change confusing “Pending PSBTs” terminology to “Unsigned PSBTs” (171) (benk10)
- UI: Improve signing UI (175, 160) (stepansnigirev, benk10)
- UI: Add reject reason to the error on broadcast (160) (stepansnigirev)
- UI: New Trezor and Ledger icons (160) (stepansnigirev, benk10)
- UI: Allow selecting device type manually (160) (benk10)
- Refactoring: Separate `logic.py` into multiple files (160) (benk10)
- Refactoring: Refactor Device, DeviceManager, Wallet, WalletManager classes (160) (benk10)
- Refactoring: Modularize supported device types (160) (benk10)
- Refactoring: Make devices and wallets accessible to each other (160) (benk10)
- Test: Improve test coverage for: Device, DeviceManager, Wallet, WalletManager classes (160, 170) (benk10)
- Test: Support multiple Bitcoin Core versions (161) (k9ert)
- Docs: Create FAQ doc (151) (kkdao)
- Docs: FAQ table of contents auto-generation (165) (k9ert)
- Docs: README updates (164) (moritzwietersheim)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14199