GitHub Advisoryadvisory · crates.io

GHSA-45p7-c959-rgcm Process crashes when the cell used as DepGroup is not alive

CRITICAL Published 2021-08-25 Modified 2021-08-02 Official page ↗

Ecosystem: crates.io
Packages: ckb
Severity: Critical
Reviewed: 2021-08-02

Affected packages

• crates.io ckb: < 0.40.0 → fixed in 0.40.0

Description

Impact It's easy to create a malign transaction which uses the dead cell as the DepGroup in the DepCells. The transaction can crash all the receiving nodes.

References

https://github.com/nervosnetwork/ckb/security/advisories/GHSA-45p7-c959-rgcm web
https://rustsec.org/advisories/RUSTSEC-2021-0109.html web