CVE-2023-40591
Denial of service via malicious p2p message in go-ethereum
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerability.
go-ethereum (geth) es una implementación de la capa de ejecución golang del protocolo Ethereum. Se puede hacer que un nodo vulnerable consuma cantidades ilimitadas de memoria cuando se manejan mensajes p2p especialmente manipulados enviados desde un nodo atacante. La corrección se incluye en la versión de geth '1.12.1-stable', es decir, '1.12.2-unstable' y posteriores. Se recomienda a los usuarios que actualicen. No hay workarounds conocidas para esta vulnerabilidad.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-08-16 CVE Reserved
- 2023-09-06 CVE Published
- 2024-09-26 CVE Updated
- 2024-10-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://geth.ethereum.org/docs/developers/geth-developer/disclosures | Product | |
https://github.com/ethereum/go-ethereum/releases/tag/v1.12.1 | Release Notes | |
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Ethereum Search vendor "Ethereum" | Go Ethereum Search vendor "Ethereum" for product "Go Ethereum" | >= 1.10.0 < 1.12.1 Search vendor "Ethereum" for product "Go Ethereum" and version " >= 1.10.0 < 1.12.1" | - |
Affected
|