CVE-2022-29177
Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node.
Does this matter?
Lower severity and a low EPSS score (0.96%). Track it; it rarely justifies an emergency change on its own.
Description
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.96% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- ethereum/go ethereum
- Source
- security-advisories@github.com
References
- https://github.com/ethereum/go-ethereum/pull/24507Patch, Third Party Advisory
- https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5Patch, Third Party Advisory
- https://github.com/ethereum/go-ethereum/pull/24507Patch, Third Party Advisory
- https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.