~ / search / GHSA-wjxw-gh3m-7pm5

GHSA-wjxw-gh3m-7pm5

DoS via malicious p2p message in Go Ethereum

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-29177

Packages

EcosystemPackageAffectedFixed in
Go github.com/ethereum/go-ethereum < 1.10.17 1.10.17

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. ### Patches The following PR addresses the problem: https://github.com/ethereum/go-ethereum/pull/24507 ### Workarounds Aside from applying the PR linked above, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack. ### Credits This bug was reported by `nrv` via [email protected], who has gracefully requested that the bounty rewards be donated to Médecins sans frontières. ### For more information If you have any questions or comments about this advisory: * Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)

References

External links from the advisory. They lead to third-party sites.