GitHub Advisoryadvisory · Go

GHSA-r33q-22hv-j29q Denial of service in github.com/ethereum/go-ethereum

MEDIUM Published 2021-06-29 Modified 2023-02-09 Official page ↗
Aliases
CVE-2020-26264
Ecosystem
Go
Packages
github.com/ethereum/go-ethereum
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-05-21

Affected packages

• Go github.com/ethereum/go-ethereum: < 1.9.25 → fixed in 1.9.25

Description

Impact A DoS vulnerability can make a LES server crash via malicious `GetProofsV2` request from a connected LES client. Patches The vulnerability was patched in https://github.com/ethereum/go-ethereum/pull/21896. Workarounds This vulnerability only concerns users explicitly enabling `les` server; disabling `les` prevents the exploit. It can also be patched by manually applying the patch in https://github.com/ethereum/go-ethereum/pull/21896. For more information If you have any questions or comments about this advisory: • Open an issue in go-ethereum • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-26264 Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References