netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-69v6-xc2j-r2jf
GHSA-m6gx-rhvj-fh52
GHSA-9856-9gg9-qcmq
This commit is contained in:
advisory-database[bot]
2025-01-30 14:38:11 +00:00
parent 478bfb5fed
commit 92fe10112b
3 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2021/06/GHSA-69v6-xc2j-r2jf/GHSA-69v6-xc2j-r2jf.json
+6 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-69v6-xc2j-r2jf",
"modified": "2023-10-03T10:13:29Z",
"modified": "2025-01-30T14:37:49Z",
"published": "2021-06-29T21:13:01Z",
"aliases": [
"CVE-2020-26241"
],
"summary": "Shallow copy bug in geth",
"details": "### Impact\nThis is a Consensus vulnerability, which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. \n\nGeth’s pre-compiled `dataCopy` (at `0x00...04`) contract did a shallow copy on invocation. An attacker could deploy a contract that \n\n- writes `X` to an EVM memory region `R`,\n- calls `0x00..04` with `R` as an argument,\n- overwrites `R` to `Y`,\n- and finally invokes the `RETURNDATACOPY` opcode.\n\nWhen this contract is invoked, a consensus-compliant node would push `X` on the EVM stack, whereas Geth would push `Y`.\n### Specific Go Packages Affected\ngithub.com/ethereum/go-ethereum/core/vm\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)\n* Email us at [security@ethereum.org](mailto:security@ethereum.org)",
"details": "### Impact\nThis is a Consensus vulnerability, which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. \n\nGeth’s pre-compiled `dataCopy` (at `0x00...04`) contract did a shallow copy on invocation. An attacker could deploy a contract that \n\n- writes `X` to an EVM memory region `R`,\n- calls `0x00..04` with `R` as an argument,\n- overwrites `R` to `Y`,\n- and finally invokes the `RETURNDATACOPY` opcode.\n\nWhen this contract is invoked, a consensus-compliant node would push `X` on the EVM stack, whereas Geth would push `Y`.\n\n\n### Patches\n\nNo standalone patches have been made. \n\n### Workarounds\n\nUpgrade to `1.9.17` or higher.\n\n### References\n\nhttps://blog.ethereum.org/2020/11/12/geth_security_release/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)\n* Email us at [security@ethereum.org](mailto:security@ethereum.org)\n",
"severity": [
{
"type": "CVSS_V3",
@@ -51,6 +51,10 @@
{
"type": "WEB",
"url": "https://blog.ethereum.org/2020/11/12/geth_security_release"
},
{
"type": "PACKAGE",
"url": "https://github.com/ethereum/go-ethereum"
}
],
"database_specific": {
advisories/github-reviewed/2021/06/GHSA-m6gx-rhvj-fh52/GHSA-m6gx-rhvj-fh52.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m6gx-rhvj-fh52",
"modified": "2021-10-08T21:25:42Z",
"modified": "2025-01-30T14:37:03Z",
"published": "2021-06-29T21:13:54Z",
"aliases": [],
"summary": "Denial of service in go-ethereum due to CVE-2020-28362",
advisories/github-reviewed/2021/08/GHSA-9856-9gg9-qcmq/GHSA-9856-9gg9-qcmq.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9856-9gg9-qcmq",
"modified": "2023-08-29T18:53:25Z",
"modified": "2025-01-30T14:37:30Z",
"published": "2021-08-30T16:15:41Z",
"aliases": [
"CVE-2021-39137"