Vulnerability Report: GO-2022-1052
- CVE-2021-21271, GHSA-p658-8693-mhvg
- Affects: github.com/tendermint/tendermint
- Published: Oct 14, 2022
- Modified: Jun 12, 2023
Mishandling of timestamps during consensus process can cause a denial of service. While reaching consensus, different tendermint nodes can observe a different timestamp for a consensus evidence. This mismatch can cause the evidence to be invalid, upon which the node producing the evidence will be asked to generate a new evidence. This new evidence will be the same, which means it will again be rejected by other nodes involved in the consensus. This loop will continue until the peer nodes decide to disconnect from the node producing the evidence.
For detailed information about this vulnerability, visit https://github.com/tendermint/tendermint/security/advisories/GHSA-p658-8693-mhvg.
Affected Packages
-
PathVersionsSymbols
-
from v0.34.0 before v0.34.3
-
from v0.34.0 before v0.34.3
Aliases
References
- https://github.com/tendermint/tendermint/security/advisories/GHSA-p658-8693-mhvg
- https://github.com/tendermint/tendermint/blob/v0.34.3/CHANGELOG.md#v0.34.3
- https://github.com/tendermint/tendermint/commit/a2a6852ab99e4a0f9e79f0ea8c1726e262e25c76
- https://vuln.go.dev/ID/GO-2022-1052.json
Credits
- cmwaters (Github)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.