CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-36025 – Incorrect Conversion between Numeric Types in Besu Ethereum Client
https://notcve.org/view.php?id=CVE-2022-36025
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in the success or failure, or if the gas is a negative 64 bit value, the execution will result in a different state root than expected, resulting in a consensus failure in networks with multiple EVM implementations. In networks with a single EVM implementation this can be used to execute with significantly more gas than then transaction requested, possibly exceeding gas limitations. • https://github.com/hyperledger/besu/security/advisories/GHSA-4456-w38r-m53x • CWE-196: Unsigned to Signed Conversion Error CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-41272 – SHL, SHR, and SAR operations trigger native exception at key values in besu
https://notcve.org/view.php?id=CVE-2021-41272
Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for shifts between approximately 2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to validate. In networks where vulnerable versions are mining with other clients or non-vulnerable versions this will result in a fork and the relevant transactions will not be included in the fork. In networks where vulnerable versions are not mining (such as Rinkeby) no fork will result and the validator nodes will stop accepting blocks. • https://github.com/hyperledger/besu/commit/4170524ac3b45185704fcfbdeeb71b0b05dfa0a1 https://github.com/hyperledger/besu/pull/3039 https://github.com/hyperledger/besu/security/advisories/GHSA-7pg2-p5vj-xp5h • CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21369 – Potential DoS in Besu HTTP JSON-RPC API
https://notcve.org/view.php?id=CVE-2021-21369
Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. • https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151 https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022 https://github.com/hyperledger/besu/pull/1144 https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q • CWE-400: Uncontrolled Resource Consumption •