hitoshura25/cvefixes huggingface dataset:
CVE-2017-14032 (Other, published 2017-08-30T20:29Z)
Description: value: ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/ARMmbed/mbedtls
Files changed:
ChangeLog
library/x509_crt.c
tests/suites/test_suite_x509parse.data
Commit message: Improve behaviour on fatal errors

If we didn't walk the whole chain, then there may be any kind of errors in the
part of the chain we didn't check, so setting all flags looks like the safe
thing to do.


Vulnerable code:
    if( profile == NULL )
        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );

            return( ret );
                return( ret );
                return( ret );
mbedtls_x509_crt_verify_max:"data_files/dir-maxpath/00.crt":"data_files/dir-maxpath":MBEDTLS_X509_MAX_INTERMEDIATE_CA+1:MBEDTLS_ERR_X509_CERT_VERIFY_FAILED:0

Fixed code:
= mbed TLS 2.y.z released YYYY-MM-DD

Changes
   * Certificate verification functions now set flags to -1 in case the full
     chain was not verified due to an internal error (including in the verify
     callback) or chain length limitations.

    if( profile == NULL )
    {
        ret = MBEDTLS_ERR_X509_BAD_INPUT_DATA;
        goto exit;
    }

            goto exit;
                goto exit;
                goto exit;
exit:
    if( ret != 0 )
    {
        *flags = (uint32_t) -1;
        return( ret );
    }

mbedtls_x509_crt_verify_max:"data_files/dir-maxpath/00.crt":"data_files/dir-maxpath":MBEDTLS_X509_MAX_INTERMEDIATE_CA+1:MBEDTLS_ERR_X509_CERT_VERIFY_FAILED:-1
CVE-2017-14032 (C, published 2017-08-30T20:29Z)
Description: value: ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/ARMmbed/mbedtls
Files changed:
ChangeLog
include/mbedtls/error.h
include/mbedtls/ssl.h
include/mbedtls/x509.h
include/mbedtls/x509_crt.h
library/error.c
library/x509_crt.c
tests/suites/test_suite_x509parse.data
Commit message: Only return VERIFY_FAILED from a single point

Everything else is a fatal error. Also improve documentation about that for
the vrfy callback.


Vulnerable code:
 * X509      2   19
 *                 information, please see \c x509parse_verify()
 *                 return 0 for anything but a fatal error.
        *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
        return( MBEDTLS_ERR_X509_CERT_VERIFY_FAILED );
mbedtls_x509_crt_verify_max:"data_files/dir-maxpath/00.crt":"data_files/dir-maxpath":MBEDTLS_X509_MAX_INTERMEDIATE_CA+1:MBEDTLS_ERR_X509_CERT_VERIFY_FAILED:-1

Fixed code:
   * With authmode set to optional, handshake is now aborted if the
     verification of the peer's certificate failed due to an overlong chain or
     a fatal error in the vrfy callback.
 * X509      2   20
 *                 information, please see \c mbedtls_x509_crt_verify()
#define MBEDTLS_ERR_X509_FATAL_ERROR                      -0x3000  /**< A fatal error occured, eg the chain is too long or the vrfy callback failed. */
 *                 return 0 for anything (including invalid certificates)
 *                 other than fatal error, as a non-zero return code
 *                 immediately aborts the verification process. For fatal
 *                 errors, a specific error code should be used (different
 *                 from MBEDTLS_ERR_X509_CERT_VERIFY_FAILED which should not
 *                 be returned at this point), or MBEDTLS_ERR_X509_FATAL_ERROR
 *                 can be used if no better code is available.
        if( use_ret == -(MBEDTLS_ERR_X509_FATAL_ERROR) )
            mbedtls_snprintf( buf, buflen, "X509 - A fatal error occured, eg the chain is too long or the vrfy callback failed" );
        /* return immediately as the goal is to avoid unbounded recursion */
        return( MBEDTLS_ERR_X509_FATAL_ERROR );
    /* prevent misuse of the vrfy callback */
    if( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED )
        ret = MBEDTLS_ERR_X509_FATAL_ERROR;

mbedtls_x509_crt_verify_max:"data_files/dir-maxpath/00.crt":"data_files/dir-maxpath":MBEDTLS_X509_MAX_INTERMEDIATE_CA+1:MBEDTLS_ERR_X509_FATAL_ERROR:-1
CVE-2017-18187 (C, published 2018-02-14T17:29Z)
Description: value: In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ARMmbed/mbedtls
Files changed:
library/ssl_srv.c
Commit message: Prevent bounds check bypass through overflow in PSK identity parsing

The check `if( *p + n > end )` in `ssl_parse_client_psk_identity` is
unsafe because `*p + n` might overflow, thus bypassing the check. As
`n` is a user-specified value up to 65K, this is relevant if the
library happens to be located in the last 65K of virtual memory.

This commit replaces the check by a safe version.


Vulnerable code:
    if( *p + 2 > end )
    if( n < 1 || n > 65535 || *p + n > end )

Fixed code:
    if( end - *p < 2 )
    if( n < 1 || n > 65535 || n > (size_t) ( end - *p ) )
CVE-2018-9988 (C, published 2018-04-10T19:29Z)
Description: value: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ARMmbed/mbedtls
Files changed:
library/ssl_cli.c
Commit message: Add bounds check before signature length read


Vulnerable code:

Fixed code:

        if( p > end - 2 )
        {
            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
            mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                            MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
            return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
        }
CVE-2018-9988 (C, published 2018-04-10T19:29Z)
Description: value: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ARMmbed/mbedtls
Files changed:
library/ssl_cli.c
Commit message: Prevent arithmetic overflow on bounds check


Vulnerable code:
        if( end != p + sig_len )

Fixed code:
        if( p != end - sig_len )
CVE-2018-9989 (C, published 2018-04-10T19:29Z)
Description: value: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ARMmbed/mbedtls
Files changed:
library/ssl_cli.c
Commit message: Add bounds check before length read


Vulnerable code:

Fixed code:
    if( (*p) > end - 2 )
    {
        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
                                    "(psk_identity_hint length)" ) );
        return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
    }
CVE-2018-9989 (C, published 2018-04-10T19:29Z)
Description: value: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ARMmbed/mbedtls
Files changed:
library/ssl_cli.c
Commit message: Prevent arithmetic overflow on bounds check


Vulnerable code:
    if( (*p) + len > end )

Fixed code:
    if( (*p) > end - len )
CVE-2024-23685 (Unknown, published 2024-01-19T21:15Z)
Description: value: Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.



Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/folio-org/mod-remote-storage
Files changed:
Commit message: Merge pull request from GHSA-m8v7-469p-5x89

MODRS-174: Hard-coded system user credentials

Vulnerable code:

Fixed code:
CVE-2013-4492 (Ruby, published 2013-12-07T00:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/svenfuchs/i18n
Files changed:
lib/i18n/exceptions.rb
test/i18n/exceptions_test.rb
Commit message: The I18n::MissingTranslation exception escapes key names for its html_message

Also added deprecation message for the :rescue_format option


Vulnerable code:
          options[:rescue_format] == :html ? exception.html_message : exception.message
        key = keys.last.to_s.gsub('_', ' ').gsub(/\b('?[a-z])/) { $1.capitalize }
        %(<span class="translation_missing" title="translation missing: #{keys.join('.')}">#{key}</span>)
    force_missing_translation_data do |exception|
      assert_equal '<span class="translation_missing" title="translation missing: de.bar.foo">Foo</span>', exception.html_message
    end

Fixed code:
require 'cgi'

          #
          # TODO: this block is to be replaced by `exception.message` when
          # rescue_format is removed
          if options[:rescue_format] == :html
            if @rescue_format_deprecation
              $stderr.puts "[DEPRECATED] I18n's :recue_format option will be removed from a future release. All exception messages will be plain text. If you need the exception handler to return an html format please set or pass a custom exception handler."
              @rescue_format_deprecation = true
            end
            exception.html_message
          else
            exception.message
          end

        key  = CGI.escape_html titleize(keys.last)
        path = CGI.escape_html keys.join('.')
        %(<span class="translation_missing" title="translation missing: #{path}">#{key}</span>)

      protected

      # TODO : remove when #html_message is removed
      def titleize(key)
        key.to_s.gsub('_', ' ').gsub(/\b('?[a-z])/) { $1.capitalize }
      end
    exception = I18n::MissingTranslationData.new(:de, :foo, :scope => :bar)
    assert_equal '<span class="translation_missing" title="translation missing: de.bar.foo">Foo</span>', exception.html_message
  end

  test "MissingTranslationData html_message html escapes key names" do
    exception = I18n::MissingTranslationData.new(:de, '<script>Evil</script>', :scope => '<iframe src="example.com" />')
    assert_equal '<span class="translation_missing" title="translation missing: de.&lt;iframe src=&quot;example.com&quot; /&gt;.&lt;script&gt;Evil&lt;/script&gt;">&lt;Script&gt;Evil&lt;/Script&gt;</span>', exception.html_message
CVE-2021-30124 (JSON, published 2021-07-30T14:15Z)
Description: value: The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sandhje/vscode-phpmd
Files changed:
README.md
package.json
Commit message: Fix remote code execution  

See CVE ID CVE-2021-30124

Vulnerable code:

Fixed code:
***Security fix in version 1.3.0:*** *Before version 1.3.0 it was possible to set `phpmd.command` through workspace settings. This unfortunately opened possibilities for a remote code execution attack. Although I recognize that some users used this workspace setting in their day to day work I feel it is more important that anyone can use this extension without worrying about their system's security. As such, since version 1.3.0, this setting is disabled at workspace level to address this issue.* 
* Ryotek for reporting the phpmd.command security issue (https://twitter.com/ryotkak)
          "scope": "machine",
CVE-2022-0472 (PHP, published 2022-02-04T23:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/jsdecena/laracom
Files changed:
project/app/Shop/Products/Requests/UpdateProductRequest.php
Commit message: Fix vulnerability report from hunter.dev


Vulnerable code:
            'weight' => ['nullable', 'numeric', 'min:0']

Fixed code:
            'weight' => ['nullable', 'numeric', 'min:0'],
            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
            'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
CVE-2022-0472 (PHP, published 2022-02-04T23:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jsdecena/laracom
Files changed:
project/app/Shop/Products/Requests/UpdateProductRequest.php
Commit message: Fix vulnerability report from hunter.dev


Vulnerable code:
            'weight' => ['nullable', 'numeric', 'min:0']

Fixed code:
            'weight' => ['nullable', 'numeric', 'min:0'],
            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
            'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
CVE-2014-9721 (Unknown, published 2015-06-03T20:59Z)
Description: value: libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/zeromq/zeromq4-x
Files changed:
Commit message: Merge pull request #101 from hintjens/master

Problem: issue #1273, protocol downgrade attack

Vulnerable code:

Fixed code:
CVE-2023-50246 (Other, published 2023-12-13T21:15Z)
Description: value: jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jqlang/jq
Files changed:
NEWS.md
src/jv.c
tests/shtest
Commit message: Merge pull request from GHSA-686w-5m7m-54vc

decNumberToString calls for a buffer that can hold a string of digits+14
characters, not a buffer of size digits+14.
We need to allocate an extra byte for the NUL byte.

-10E-1000010001, for example, will be stringified as -1.0E-1000010000
and decNumberToString will currently write an extra NUL byte after the
allocated buffer in the heap.

Originally reported by @SEU-SSL on GitHub.

Ref: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574

Fixes GHSA-686w-5m7m-54vc

Vulnerable code:
- CVE-2023-50246: ....
    int len = jvp_dec_number_ptr(n)->digits + 14;

Fixed code:
- CVE-2023-50246: Fix heap buffer overflow in jvp\_literal\_number\_literal
    int len = jvp_dec_number_ptr(n)->digits + 15 /* 14 + NUL */;
# CVE-2023-50246: No heap overflow for '-10E-1000000001'
$VALGRIND $Q $JQ . <<\NUM
-10E-1000000001
NUM
CVE-2023-50268 (Other, published 2023-12-13T21:15Z)
Description: value: jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jqlang/jq
Files changed:
NEWS.md
src/jv.c
tests/shtest
Commit message: Merge pull request from GHSA-7hmr-442f-qc8j

The unit allocated for decNumberCompare was accidentally removed by
commit 680baeffeb7983e7570b5e68db07fe47f94db8c7 (PR #2804)

This caused a stack overflow when comparing a nan with a payload of 1000
or more.

This bug was found by OSS-fuzz.
Ref: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
Fixes GHSA-7hmr-442f-qc8j

It also fixes 1e999999999 > 1e-1147483646   triggering UBSAN errors
Fixes #2968

Vulnerable code:
- CVE-2023-50268: ....
    decNumber res;
    decNumberCompare(&res,
    if (decNumberIsZero(&res)) {
    } else if (decNumberIsNegative(&res)) {

Fixed code:
- CVE-2023-50268: fix stack-buffer-overflow if comparing nan with payload
    struct {
      decNumber number;
      decNumberUnit units[1];
    } res;

    decNumberCompare(&res.number,
    if (decNumberIsZero(&res.number)) {
    } else if (decNumberIsNegative(&res.number)) {
# CVE-2023-50268: No stack overflow comparing a nan with a large payload
$VALGRIND $Q $JQ '1 != .' <<\EOF >/dev/null
Nan4000
EOF
CVE-2022-4526 (Python, published 2022-12-15T21:15Z)
Description: value: A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic. Affected by this issue is some unknown functionality of the file photologue/templates/photologue/photo_detail.html of the component Default Template Handler. The manipulation of the argument object.caption leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.16 is able to address this issue. The name of the patch is 960cb060ce5e2964e6d716ff787c72fc18a371e7. It is recommended to apply a patch to fix this issue. VDB-215906 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/richardbarran/django-photologue
Files changed:
CHANGELOG.txt
docs/pages/usage.rst
photologue/templates/photologue/photo_detail.html
photologue/tests/test_views_photo.py
Commit message: Prevent XSS injection with default template.


Vulnerable code:
        {% if object.caption %}<p>{{ object.caption|safe }}</p>{% endif %}

Fixed code:
- Do not allow JS injection into the Photo caption field (#223) (bug detected by Domiee13).

Data integrity
--------------
Photologue will store 'as-is' any data stored for galleries and photos.
You may want to enforce some data integrity rules - e.g. to sanitise
any javascript injected into a ``Photo`` ``caption`` field. An easy way to do this
would be to add extra processing on a ``post-save`` signal.

Photologue does not sanitise data itself as you may legitimately want to store html and
javascript in a caption field e.g. if you use a rich-text editor.

        {% if object.caption %}<p>{{ object.caption }}</p>{% endif %}
    def test_detail_photo_xss(self):
        """Check that the default templates handle XSS."""
        self.photo.title = '<img src=x onerror=alert("title")>'
        self.photo.caption = '<img src=x onerror=alert(origin)>'
        self.photo.save()
        response = self.client.get('/ptests/photo/2011/12/23/fake-photo/')
        self.assertContains(response, 'Photologue Demo - &lt;img src=x onerror=alert(&quot;title&quot;)&gt;')
        self.assertNotContains(response, '<img src=x onerror=alert("title")>')
        self.assertContains(response, '&lt;img src=x onerror=alert(origin)&gt;')
        self.assertNotContains(response, '<img src=x onerror=alert(origin)>')
CVE-2017-20180 (C++, published 2023-03-06T11:15Z)
Description: value: A vulnerability classified as critical has been found in Zerocoin libzerocoin. Affected is the function CoinSpend::CoinSpend of the file CoinSpend.cpp of the component Proof Handler. The manipulation leads to insufficient verification of data authenticity. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as ce103a09ec079d0a0ed95475992348bed6e860de. It is recommended to apply a patch to fix this issue. VDB-222318 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/Zerocoin/libzerocoin
Files changed:
CoinSpend.cpp
CoinSpend.h
Commit message: Patch serial # exploit.

The serial # range needs to be checked or else the serial number is able to be incremented to a value that will create a valid proof, thus allowing multiple spends of a single mint.


Vulnerable code:

Fixed code:
	// The serial # needs to be within the specified range our else it can be incremented by the modulus and create another valid proof
	if (!HasValidSerial()) {
		throw ZerocoinException("Invalid serial # range");
	}

bool CoinSpend::HasValidSerial() const
{
	return coinSerialNumber > 0 && coinSerialNumber < params->coinCommitmentGroup.groupOrder;
}

	bool HasValidSerial() const;