Vulnerability · Published May 31, 2023 · Assigned by GitHub_M
CVE-2023-33964mx-chain-go does not treat invalid transaction with wrong username correctly
High 8.6
In plain English
A high-severity improper input validation in mx-chain-go from multiversx. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces `processIfTxErrorCrossShard` for the metachain transaction processor. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/multiversx/mx-chain-go | 1.4.16 | GHSA-7xpv-4pm9-xch2 |
| Go | github.com/multiversx/mx-chain-go | 1.4.16 | GO-2023-1806 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| multiversx | mx-chain-go | < 1.4.16 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N