{"id":"CVE-2021-3195","aliases":["ALPINE-CVE-2021-3195","EUVD-2021-26536","GHSA-xvf3-hffw-q8j7","openSUSE-SU-2022:0072-1","openSUSE-SU-2024:10654-1","openSUSE-SU-2026:21149-1"],"status":"disputed","title":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g.,...","description":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01296,"percentile":0.70769,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2021-01-21T07:48:58Z","modified":"2026-11-03T06:32:33Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"bitcoin","fixed_in":["0.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"bitcoin","fixed_in":["0.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"bitcoin","fixed_in":["0.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"bitcoin","fixed_in":["0.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"bitcoin","fixed_in":["0.21.1-r0"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"bitcoin","fixed_in":["0.21.2-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"bitcoin","fixed_in":["0.21.2-bp153.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"bitcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"bitcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"bitcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"bitcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"bitcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-r0"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"bitcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.2-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"bitcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.2-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"bitcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1-bp160.2.1"}]}],"bundled":6}],"products":[{"vendor":"bitcoin","product":"bitcoin_core"}],"references":[{"url":"https://github.com/bitcoin/bitcoin/issues/20866","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3195"},{"url":"https://github.com/advisories/GHSA-xvf3-hffw-q8j7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3195","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZQOIWU7XODRDIITDKWB45QLM5US3ATJW/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3195","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17144","tags":["web"]},{"url":"https://bugzilla.suse.com/1125092","tags":["report"]},{"url":"https://bugzilla.suse.com/1149711","tags":["report"]},{"url":"https://bugzilla.suse.com/1181784","tags":["report"]},{"url":"https://bugzilla.suse.com/1181786","tags":["report"]},{"url":"https://bugzilla.suse.com/1217678","tags":["report"]},{"url":"https://bugzilla.suse.com/1231507","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-37192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35202","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3195","description":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions","status":"disputed","published":"2021-01-21T07:48:58Z","modified":"2024-08-03T16:45:51.391Z","updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26536","description":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions","status":"published","published":"2021-01-21T07:48:58Z","modified":"2024-08-03T16:45:51Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-xvf3-hffw-q8j7","title":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g.,...","description":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call.","status":"published","published":"2022-05-24T17:40:23Z","modified":"2024-03-21T03:33:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:55:42.026509Z"}],"nvd":[{"id":"CVE-2021-3195","description":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions","status":"disputed","published":"2021-01-26T18:16:28.427Z","modified":"2026-06-17T04:04:49.51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"ALPINE-CVE-2021-3195","description":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions","status":"published","published":"2021-01-26T18:16:28.427Z","modified":"2026-11-03T06:32:33.352521621Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2021-3195","description":"bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions","status":"published","published":"2021-01-26T18:16:28.427Z","modified":"2026-10-20T10:54:41.079707473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"openSUSE-SU-2022:0072-1","title":"Security update for bitcoin","description":"This update for bitcoin fixes the following issues:\n\nUpdate to version 0.21.2\n\n* P2P protocol and network code\n  * use NetPermissions::HasFlag() in CConnman::Bind()\n  * Rate limit the processing of rumoured addresses\n* Wallet\n  * Do not iterate a directory if having an error while accessing it\n* RPC\n  * Reset scantxoutset progress before inferring descriptors\n* Build System\n  * depends: update Qt 5.9 source url\n  * Update Windows code signing certificate\n  * Use custom MacOS code signing tool\n  * Fix build with Boost 1.77.0\n* Tests and QA\n  * Build with --enable-werror by default, and document exceptions\n  * Fix intermittent feature_taproot issue\n  * Fix macOS brew install command\n  * add missing ECCVerifyHandle to base_encode_decode\n  * Run fuzzer task for the master branch only\n* GUI\n  * Do not use QClipboard::Selection on Windows and macOS.\n  * Remove user input from URI error message\n  * Draw 'eye' sign at the beginning of watch-only addresses\n* Miscellaneous\n  * Fix crash when parsing command line with -noincludeconf=0\n  * util: Properly handle -noincludeconf on command line (take 2)\n\nUpdate to version 0.21.1\n\n* Consensus:\n  * Speedy trial support for versionbits\n  * Speedy trial activation parameters for Taproot\n* P2P protocol and network code\n  * allow CSubNet of non-IP networks\n  * Avoid UBSan warning in ProcessMessage\n* Wallet\n  * Introduce DeferredSignatureChecker and have\n    SignatureExtractorClass subclass it\n  * Avoid requesting fee rates multiple times during coin selection\n* RPC and other APIs:\n  * Disallow sendtoaddress and sendmany when private keys disabled\n    CVE-2021-3195\n\nUpdate to version 0.21.0:\n\n* For full details see release-notes-0.21.0.md\n\nUpdate to version 0.20.1\n\n* Mining\n  * Fix GBT: Restore '!segwit' and 'csv' to 'rules' key\n* P2P protocol and network code\n  * Replace automatic bans with discouragement filter\n* Wallet\n  * Handle concurrent wallet loading\n  * Minimal fix to restore conflicted transaction notifications \n* RPC and other APIs\n  * Increment input value sum only once per UTXO in decodepsbt\n  * psbt: Increment input value sum only once per UTXO in decodepsbt\n  * psbt: Include and allow both non_witness_utxo and witness_utxo for segwit inputs\n* GUI\n  * Add missing QPainterPath include\n  * update Qt base translations for macOS release\n* Misc\n  * util: Don't reference errno when pthread fails\n  * Fix locking on WSL using flock instead of fcntl\n\nUpdate to version 0.20.0:\n\n* See https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-0.20.0.md\n\n- Do not run bitcoind in daemon mode. Running it not as a\n  background process makes it working properly with journald\n  (instead of writing logs in /var/log).\n\nUpdate to version 0.19.1:\n\n* Wallet\n  * Fix origfee return for bumpfee with feerate arg\n  * Fix unique_ptr usage in boost::signals2\n  * Fix issue with conflicted mempool tx in listsinceblock\n  * Bug: IsUsedDestination shouldn't use key id as script id for\n    ScriptHash\n  * IsUsedDestination should count any known single-key address\n  * Reset reused transactions cache\n* RPC and other APIs\n  * cli: Fix fatal leveldb error when specifying\n    -blockfilterindex=basic twice\n  * require second argument only for scantxoutset start action\n  * zmq: Fix due to invalid argument and multiple notifiers\n  * psbt: handle unspendable psbts\n  * psbt: check that various indexes and amounts are within\n    bounds\n* GUI\n  * Fix missing qRegisterMetaType for size_t\n  * disable File-\u003eCreateWallet during startup\n  * Fix comparison function signature\n  * Fix unintialized WalletView::progressDialog\n* Tests and QA\n  * Appveyor improvement - text file for vcpkg package list\n  * fix 'bitcoind already running' warnings on macOS\n  * add missing #include to fix compiler errors\n* Platform support\n  * Update msvc build for Visual Studio 2019 v16.4\n  * Updates to appveyor config for VS2019 and Qt5.9.8 + msvc\n    project fixes\n  * bug-fix macos: give free bytes to F_PREALLOCATE\n* Miscellaneous\n  * init: Stop indexes on shutdown after ChainStateFlushed\n    callback\n  * util: Add missing headers to util/fees.cpp\n  * Unbreak build with Boost 1.72.0\n  * scripts: Fix symbol-check \u0026 security-check argument passing\n  * Log to net category for exceptions in ProcessMessages\n  * Update univalue subtree\n","status":"published","published":"2022-03-03T19:01:19Z","modified":"2026-02-04T04:29:37.282977Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:10654-1","title":"bitcoin-qt5-0.21.1-2.2 on GA media","description":"These are all security issues fixed in the bitcoin-qt5-0.21.1-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:26:29.861115Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2026:21149-1","title":"Security update for bitcoin","description":"This update for bitcoin fixes the following issues:\n\nChanges in bitcoin:\n\n- Reference the tracking bugs for CVEs already fixed in current bitcoin\n  (the affected versions all predate the shipped release):\n  * CVE-2018-20587 (boo#1125092)\n  * CVE-2019-15947 (boo#1149711)\n  * CVE-2020-14198 (boo#1181786)\n  * CVE-2021-3195 (boo#1181784)\n  * CVE-2023-37192 (boo#1217678)\n  * CVE-2024-35202 (boo#1231507)\n","status":"published","published":"2026-06-23T12:48:21Z","modified":"2026-06-30T18:24:45.556135363Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}