netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-wvc4-j7g5-4f79
GHSA-ppjg-v974-84cm
This commit is contained in:
advisory-database[bot]
2023-11-08 17:40:42 +00:00
parent 9442a7f715
commit 4a4cf697c8
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/03/GHSA-wvc4-j7g5-4f79/GHSA-wvc4-j7g5-4f79.json
+9 -2
View File
@@ -25,11 +25,14 @@
"introduced": "0.9.0"
},
{
"last_affected": "0.24.0"
"fixed": "0.24.1"
}
]
}
]
],
"database_specific": {
"last_known_affected_version_range": "<= 0.24.0"
}
}
],
"references": [
@@ -41,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/nats-io/nats.rs/pull/887"
},
{
"type": "WEB",
"url": "https://github.com/nats-io/nats.rs/commit/9bacb86a480803ece9d1a45aa443081cf1eb815c"
},
{
"type": "PACKAGE",
"url": "https://github.com/nats-io/nats.rs"
advisories/github-reviewed/2023/09/GHSA-ppjg-v974-84cm/GHSA-ppjg-v974-84cm.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ppjg-v974-84cm",
"modified": "2023-09-06T19:49:46Z",
"modified": "2023-11-08T17:39:39Z",
"published": "2023-09-06T19:49:46Z",
"aliases": [
"CVE-2023-40591"
],
"summary": "Go-Ethereum vulnerable to denial of service via malicious p2p message",
"details": "### Impact\n\nA vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.\n\nDetails about this bug will be released within 4-8 weeks, as per our official [vulnerability disclosure policy](https://geth.ethereum.org/docs/developers/geth-developer/disclosures).\n### Patches\n\nThe fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. \n\n### Workarounds\n\nNo known workarounds. \n\n### Credits\n\nThis bug was reported by Patrick McHardy and reported via [bounty@ethereum.org](mailto:bounty@ethereum.org). \n\n### References\n\n",
"details": "### Impact\n\nA vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.\n\n### Details\n\nThe p2p handler spawned a new goroutine to respond to `ping` requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.\n\n### Patches\n\nThe fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. \n\nFixed by https://github.com/ethereum/go-ethereum/pull/27887\n\n### Workarounds\n\nNo known workarounds. \n\n### Credits\n\nThis bug was reported by Patrick McHardy and reported via [bounty@ethereum.org](mailto:bounty@ethereum.org). \n\n### References\n\n",
"severity": [
{
"type": "CVSS_V3",