CVE-2023-42806mediumCWE-347

CVE-2023-42806: falha de média gravidade em input-output-hk hydra

Snapshot signature not including HeadID will allow replay attacks

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar hydra

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.5%
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying `$\mathsf{cid}$` allows an attacker (which must be a participant of this head) to use a snapshot from an old head instance with the same participants to close the head or contest the state with it. This can lead to an incorrect distribution of value (= value extraction attack; hard, but possible) or prevent the head to finalize because the value available is not consistent with the closed utxo state (= denial of service; easy). A patch is planned for version 0.13.0. As a workaround, rotate keys between heads so not to re-use keys and not result in the same multi-signature participants.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
input-output-hk · hydra
CVEs relacionadas — input-output-hk hydra

No mesmo produto, das mais perigosas para as menos.

CVE-2023-42449HIGHMalicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commitsEPSS 1.1%CVE-2023-38701CRITICALHydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyoneEPSS 1.1%CVE-2023-42448HIGHHydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadlineEPSS 1.0%