CVE-2023-34458highCWE-400

CVE-2023-34458: falha de alta gravidade em multiversx mx-chain-go

mx-chain-go's relayed transactions always increment nonce

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mx-chain-go+ Monitorar github.com/multiversx/mx-chain-go

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 1.3%
mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Produtos afetados
multiversx · mx-chain-go
CVEs relacionadas — multiversx mx-chain-go

No mesmo produto, das mais perigosas para as menos.

CVE-2023-33964HIGHmx-chain-go does not treat invalid transaction with wrong username correctlyEPSS 0.6%