Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/ethereum/go-ethereum: CVE-2023-40591 #2046

Closed
GoVulnBot opened this issue Sep 6, 2023 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/ethereum/go-ethereum: CVE-2023-40591 #2046

GoVulnBot opened this issue Sep 6, 2023 · 1 comment
Assignees
@neild

Comments

@GoVulnBot
Copy link

CVE-2023-40591 references github.com/ethereum/go-ethereum, which may be a Go module.

Description:
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version 1.12.1-stable, i.e, 1.12.2-unstable and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/ethereum/go-ethereum
      vulnerable_at: 1.12.2
      packages:
        - package: go-ethereum
description: |-
    go-ethereum (geth) is a golang execution layer implementation of the Ethereum
    protocol. A vulnerable node, can be made to consume unbounded amounts of memory
    when handling specially crafted p2p messages sent from an attacker node. The fix
    is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards.
    Users are advised to upgrade. There are no known workarounds for this
    vulnerability.
cves:
    - CVE-2023-40591
references:
    - advisory: https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm
    - web: https://geth.ethereum.org/docs/developers/geth-developer/disclosures
    - web: https://github.com/ethereum/go-ethereum/releases/tag/v1.12.1
@neild neild self-assigned this Sep 14, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/528635 mentions this issue: data/reports: add GO-2023-2046.yaml

This was referenced May 6, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@neild neild

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@neild @gopherbot @GoVulnBot