Update: Go-Ethereum vulnerable to denial of service via malicious p2p message

[taariq]

3 repositories in your palomachain organization might be affected by a security vulnerability.
https://github.com/advisories/GHSA-ppjg-v974-84cm/dependabot?query=user:palomachain

[byte-bandit]

As discussed, we're not a direct consumer of go-ethereum any longer.

At the moment, we rely mostly on

• op-geth which forks go-ethereum one way
• arb-geth, which forks it the other way

At the moment, the Arbitrum fork has merged in the changes for 1.12.0 only, 1.12.1 is still outstanding: OffchainLabs/go-ethereum#248

The same goes for Optimism, which is also stuck as 1.12.0 with no indicator of 1.12.1 on the horizon: ethereum-optimism/op-geth#104

This means we're effectively blocked until both teams update their library to include the changes from 1.12.1 of go-ethereum.

[taariq]

Closing until our upstream partners release.

[byte-bandit]

@taariq Let's capture this as something to revisit in the future somewhere, I don't want to lose sight of it until it's too late.