GitHub Advisoryadvisory · crates.io

GHSA-wjxc-pjx9-4wvm Nervos CKB Panic on malformed input

HIGH Published 2024-02-03 Modified 2024-02-03 Official page ↗

Ecosystem: crates.io
Packages: ckb
Severity: High
Reviewed: 2024-02-03

Affected packages

• crates.io ckb: < 0.34.2 → fixed in 0.34.2

Description

Impact CKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages References https://github.com/BurntSushi/rust-snappy/issues/29

References

https://github.com/nervosnetwork/ckb/security/advisories/GHSA-wjxc-pjx9-4wvm web