GHSA-wjxw-gh3m-7pm5
DoS via malicious p2p message in Go Ethereum
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/ethereum/go-ethereum | < 1.10.17 | 1.10.17 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node.
### Patches
The following PR addresses the problem: https://github.com/ethereum/go-ethereum/pull/24507
### Workarounds
Aside from applying the PR linked above, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack.
### Credits
This bug was reported by `nrv` via [email protected], who has gracefully requested that the bounty rewards be donated to Médecins sans frontières.
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
References
External links from the advisory. They lead to third-party sites.