CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023.

• CWE-338

• https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/commands/seed.cpp#L44Third Party Advisory
• https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/utility.cpp#L78Third Party Advisory
• https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
• https://github.com/libbitcoin/libbitcoin-system/blob/a1b777fc51d9c04e0c7a1dec5cc746b82a6afe64/src/crypto/pseudo_random.cpp#L66C12-L78Third Party Advisory
• https://milksad.info/disclosure.htmlThird Party Advisory
• https://news.ycombinator.com/item?id=37054862Third Party Advisory
• https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/commands/seed.cpp#L44Third Party Advisory
• https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/utility.cpp#L78Third Party Advisory
• https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
• https://github.com/libbitcoin/libbitcoin-system/blob/a1b777fc51d9c04e0c7a1dec5cc746b82a6afe64/src/crypto/pseudo_random.cpp#L66C12-L78Third Party Advisory
• https://milksad.info/disclosure.htmlThird Party Advisory
• https://news.ycombinator.com/item?id=37054862Third Party Advisory

Published

Aug 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3990A vulnerability classified as problematic has been found in …6.1
• CVE-2023-39902A software vulnerability has been identified in the U-Boot S…7.8
• CVE-2023-39903An issue was discovered in Fujitsu Software Infrastructure M…5
• CVE-2023-39908The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does …7.5
• CVE-2023-39909Ericsson Network Manager before 23.2 mishandles Access Contr…8.8
• CVE-2023-3991An OS command injection vulnerability exists in the httpd ip…9.8
• CVE-2023-39912Zoho ManageEngine ADManager Plus before 7203 allows Help Des…4.9
• CVE-2023-39913Deserialization of Untrusted Data, Improper Input Validation…8.8
• CVE-2023-39914NLnet Labs' bcder library up to and including version 0.7.2 …7.5
• CVE-2023-39915NLnet Labs' Routinator up to and including version 0.12.1 ma…7.5
• CVE-2023-39916NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as w…6.5
• CVE-2023-39917Cross-Site Request Forgery (CSRF) vulnerability in Photo Gal…8.8