CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-25072 – Uncontrolled resource consumption in github.com/tendermint/tendermint
https://notcve.org/view.php?id=CVE-2019-25072
Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector. Debido a la compatibilidad con la compresión Gzip en los cuerpos de las solicitudes, así como a la falta de limitación del tamaño de los cuerpos de las respuestas, un servidor malicioso puede hacer que un cliente consuma una cantidad significativa de recursos del sistema, lo que puede usarse como un vector de denegación de servicio. • https://github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613 https://github.com/tendermint/tendermint/pull/3430 https://pkg.go.dev/vuln/GO-2020-0037 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-23507 – Light client verification not taking into account chain ID
https://notcve.org/view.php?id=CVE-2022-23507
Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes). The light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. • https://github.com/informalsystems/tendermint-rs/security/advisories/GHSA-xqqc-c5gw-c5r5 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21271 – Denial of service in TenderMint Core
https://notcve.org/view.php?id=CVE-2021-21271
Tendermint Core is an open source Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine - written in any programming language - and securely replicates it on many machines. Tendermint Core v0.34.0 introduced a new way of handling evidence of misbehavior. As part of this, we added a new Timestamp field to Evidence structs. This timestamp would be calculated using the same algorithm that is used when a block is created and proposed. (This algorithm relies on the timestamp of the last commit from this specific block.) • https://github.com/tendermint/tendermint/blob/v0.34.3/CHANGELOG.md#v0.34.3 https://github.com/tendermint/tendermint/commit/a2a6852ab99e4a0f9e79f0ea8c1726e262e25c76 https://github.com/tendermint/tendermint/security/advisories/GHSA-p658-8693-mhvg • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2020-15091 – Denial of Service in TenderMint
https://notcve.org/view.php?id=CVE-2020-15091
TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong block. This may happen naturally if you start a network, have it run for some time and restart it (**without changing chainID**). A malicious block proposer (even with a minimal amount of stake) can use this vulnerability to completely halt the network. This issue is fixed in Tendermint 0.33.6 which checks all the signatures are for the block with 2/3+ majority before creating a commit. TenderMint desde versión 0.33.0 y anteriores a versión 0.33.6, permite a proponentes de bloque incluir firmas para el bloque equivocado. • https://github.com/tendermint/tendermint/commit/480b995a31727593f58b361af979054d17d84340 https://github.com/tendermint/tendermint/issues/4926 https://github.com/tendermint/tendermint/security/advisories/GHSA-6jqj-f58p-mrw3 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-5303 – Denial of service in Tendermint
https://notcve.org/view.php?id=CVE-2020-5303
Tendermint before versions 0.33.3, 0.32.10, and 0.31.12 has a denial-of-service vulnerability. Tendermint does not limit the number of P2P connection requests. For each p2p connection, it allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. Additionally, Tendermint does not reclaim activeID of a peer after it's removed in Mempool reactor. • https://github.com/tendermint/tendermint/commit/e2d6859afd7dba4cf97c7f7d412e7d8fc908d1cd https://github.com/tendermint/tendermint/security/advisories/GHSA-v24h-pjjv-mcp6 https://hackerone.com/reports/820317 • CWE-787: Out-of-bounds Write CWE-789: Memory Allocation with Excessive Size Value •