kayabaNerve discovers security vulnerability in monero-python module, j-berman helps emesik release v1.0.2 patch

kayabaNerve¹ has discovered a security vulnerability in the monero-python² module and j-berman³ helped emesik⁴, the project maintainer, to quickly push out the v1.0.2⁵ release that patches it:

If anyone is using my monero Python module for output recognition, please upgrade immediately to version 1.0.2. (emesik)⁶

According to emesik, a malicious user could prepare a forged transaction and push an arbitrary payment amount and the vulnerable code in earlier versions (<1.0.2) would blindly trust this operation.

Even though users that don’t use the module for transaction scanning and to identify outputs using the view key are not affected, they should still upgrade to the newest version.

To learn more about the module, consult the project documentation⁷.

To support the development of the monero-python open source library, you can donate some XMR to the address listed in the README⁸.

Credits: thanks to plowsof⁹ for submitting this news tip.