CVE-2020-15091mediumCWE-347

CVE-2020-15091: medium-severity vulnerability in tendermint

Denial of Service in TenderMint

Published · Updated

Follow this CVE+ Monitor tendermint+ Monitor github.com/tendermint/tendermint

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.9%
TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong block. This may happen naturally if you start a network, have it run for some time and restart it (**without changing chainID**). A malicious block proposer (even with a minimal amount of stake) can use this vulnerability to completely halt the network. This issue is fixed in Tendermint 0.33.6 which checks all the signatures are for the block with 2/3+ majority before creating a commit.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
tendermint · tendermint
Related CVEs — tendermint

In the same product, most dangerous first.

CVE-2021-21271MEDIUMDenial of service in TenderMint CoreEPSS 1.8%