Vulnerability · Published Dec 11, 2020 · Assigned by GitHub_M

CVE-2020-26264LES Server DoS via GetProofsV2

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in go-ethereum from ethereum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.9%top 20.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/ethereum/go-ethereum	1.9.25	GHSA-r33q-22hv-j29q
Go	github.com/ethereum/go-ethereum	1.9.25	GO-2021-0063

Affected products (as reported)

Vendor	Product	Versions
ethereum	go-ethereum	< 1.9.25

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29q x_refsource_CONFIRM
https://github.com/ethereum/go-ethereum/pull/21896 x_refsource_MISC
https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46 x_refsource_MISC
https://github.com/ethereum/go-ethereum/releases/tag/v1.9.25 x_refsource_MISC