GHSA-wjxw-gh3m-7pm5

    Dashboard / Vulnerabilities / GHSA-wjxw-gh3m-7pm5

    GHSA-wjxw-gh3m-7pm5

    Published: 24 May 2022Last Modified: 21 Aug 2024

    Summary: DoS via malicious p2p message in Go Ethereum

    Details: ### Impact A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. ### Patches The following PR addresses the problem: https://github.com/ethereum/go-ethereum/pull/24507 ### Workarounds Aside from applying the PR linked above, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack. ### Credits This bug was reported by `nrv` via [email protected], who has gracefully requested that the bounty rewards be donated to Médecins sans frontières. ### For more information If you have any questions or comments about this advisory: * Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)

    References: https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5, https://nvd.nist.gov/vuln/detail/CVE-2022-29177, https://github.com/ethereum/go-ethereum/pull/24507, github.com/ethereum/go-ethereum

    Affected packages

    Package

    Name: github.com/ethereum/go-ethereum

    Purl: pkg:golang/github.com/ethereum/go-ethereum

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.10.17

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-wjxw-gh3m-7pm5 | CVE-DB