Vulnerability · Published Sep 6, 2022 · Assigned by GitHub_M
CVE-2022-36058elrond-go MultiESDTNFTTransfer call on a SC address with missing function name
High 7.5
In plain English
A high-severity improper input validation in elrond-go from ElrondNetwork. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks (historical or actual) could encounter a `MultiESDTNFTTransfer` transaction like this: `MultiESDTNFTTransfer` with a missing function name. Basic functionality like p2p messaging, storage, API requests and such are unaffected. Version 1.3.34 contains a fix for this issue. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/ElrondNetwork/elrond-go | 1.3.34 | GHSA-qf7j-25g9-r63f |
| Go | github.com/ElrondNetwork/elrond-go | 1.3.34 | GO-2022-0970 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ElrondNetwork | elrond-go | <= 1.3.33 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/ElrondNetwork/elrond-go/security/advisories/GHSA-qf7j-25g9-r63f x_refsource_CONFIRM
- https://github.com/ElrondNetwork/elrond-go/commit/cb487fd7be2a2077638eb34ae771a73630c870c7 x_refsource_MISC
- https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L402 x_refsource_MISC