GHSA-M6GX-RHVJ-FH52严重已审查

Denial of service in go-ethereum due to CVE-2020-28362

OSV 1.4.0 · github-reviewed · 修改于 2025-01-30 22:37

发布时间

2021-06-30 05:13

GitHub 审查时间

2021-05-22 05:49

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/06/GHSA-m6gx-rhvj-fh52/GHSA-m6gx-rhvj-fh52.json

公告说明

Impact

Versions of Geth built with Go <1.15.5 or <1.14.12 are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.

We recommend all users to rebuild (ideally v1.9.24) with Go 1.15.5 or 1.14.12, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release v1.9.24 ourselves built with Go 1.15.5.

Patches

This is not an issue in go-ethereum, rebuilding an older version with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.

Workarounds

Rebuilding with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in go-ethereum
Email us at [email protected]

受影响的软件包

标识信息

别名 / CVE

无

CWE

无

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-m6gx-rhvj-fh52",
  "aliases": [],
  "details": "### Impact\nVersions of Geth built with Go `<1.15.5` or `<1.14.12` are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.\n\nWe recommend all users to rebuild (ideally `v1.9.24`) with Go `1.15.5` or `1.14.12`, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release `v1.9.24` ourselves built with Go `1.15.5`.\n\n### Patches\nThis is not an issue in go-ethereum, rebuilding an older version with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. \n\n### Workarounds\nRebuilding with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. \n\n### References\n- https://blog.ethereum.org/2020/11/12/geth_security_release/\n- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)\n* Email us at [[email protected]](mailto:[email protected])\n",
  "summary": "Denial of service in go-ethereum due to CVE-2020-28362",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.24"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/ethereum/go-ethereum",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2025-01-30T14:37:03Z",
  "severity": [],
  "published": "2021-06-29T21:13:54Z",
  "references": [
    {
      "url": "https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6gx-rhvj-fh52",
      "type": "WEB"
    },
    {
      "url": "https://github.com/ethereum/go-ethereum",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-05-21T21:49:12Z"
  }
}