GHSA-r9rv-9mh8-pxf4

    Dashboard / Vulnerabilities / GHSA-r9rv-9mh8-pxf4

    GHSA-r9rv-9mh8-pxf4

    Published: 2 Feb 2024Last Modified: 2 Feb 2024

    Summary: Nervos CKB BlockTimeTooNew should not be considered as invalid block

    Details: ### Impact Currently, when a node receives a block in future according to its local wall clock, it will mark the block as invalid and ban the peer. If the header's timestamp is more than 15 seconds ahead of our current time. In that case, the header may become valid in the future, and we don't want to disconnect a peer merely for serving us one too-far-ahead block header, to prevent an attacker from splitting the network by mining a block right at the 15 seconds boundary. ### Patches Upgrade to v0.33.1 or above. ### Workarounds Don't ban peer serving too-far-ahead block header.

    References: https://github.com/nervosnetwork/ckb/security/advisories/GHSA-r9rv-9mh8-pxf4, https://github.com/nervosnetwork/ckb/commit/760d447c8b600df0539debe80b1625836fc72819

    Affected packages

    Package

    Name: ckb

    Purl: pkg:cargo/ckb

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.33.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High