CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-42319
https://notcve.org/view.php?id=CVE-2023-42319
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic. Geth (también conocido como go-ethereum) hasta 1.13.4, cuando se usa --http --graphql, permite a atacantes remotos provocar una Denegación de Servicio (consumo de memoria y bloqueo del daemon) a través de una consulta GraphQL manipulada. NOTA: la posición del proveedor es que "el endpoint Graphql [no está] diseñado para resistir ataques de clientes hostiles ni para manejar grandes cantidades de clientes/tráfico. • https://blog.mevsec.com/posts/geth-dos-with-graphql https://geth.ethereum.org/docs/fundamentals/security •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40591 – Denial of service via malicious p2p message in go-ethereum
https://notcve.org/view.php?id=CVE-2023-40591
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerability. go-ethereum (geth) es una implementación de la capa de ejecución golang del protocolo Ethereum. • https://geth.ethereum.org/docs/developers/geth-developer/disclosures https://github.com/ethereum/go-ethereum/releases/tag/v1.12.1 https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2022-37450
https://notcve.org/view.php?id=CVE-2022-37450
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022. Go Ethereum (también se conoce como geth) versiones hasta 1.10.21, permite a atacantes aumentar las recompensas mediante la minería de bloques en determinadas situaciones, y el uso de una manipulación de los valores de diferencia de tiempo para lograr el reemplazo de los bloques de la cadena principal, también se conoce como Riskless Uncle Making (RUM), como es explotado "in the wild" en 2020 hasta 2022 • http://dx.doi.org/10.13140/RG.2.2.27813.99043 https://github.com/ethereum/go-ethereum/blob/671094279e8d27f4b4c3c94bf8b636c26b473976/core/forkchoice.go#L91-L94 https://medium.com/%40aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef https://news.ycombinator.com/item?id=32354896 •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29177 – DoS via malicious p2p message in Go-Ethereum
https://notcve.org/view.php?id=CVE-2022-29177
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack. Go Ethereum es la implementación oficial en Golang del protocolo Ethereum. • https://github.com/ethereum/go-ethereum/pull/24507 https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-42219
https://notcve.org/view.php?id=CVE-2021-42219
Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go. Se ha detectado que Go-Ethereum versión v1.10.9, contiene un problema que permite a atacantes causar una denegación de servicio (DoS) por medio del envío de una cantidad excesiva de mensajes a un nodo. Esto es causado por una falta de memoria en el componente /ethash/algorithm.go • https://docs.google.com/document/d/1dYFSpNZPC0OV-n1mMqdc269u9yYU1XQy/edit?usp=sharing&ouid=112110745137218798745&rtpof=true&sd=true •