CVE-2021-21271
Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint
6.5
MEDIUM
CVSS 3.1
EPSS 1.7%
描述
Mishandling of timestamps during consensus process can cause a denial of service. While reaching consensus, different tendermint nodes can observe a different timestamp for a consensus evidence. This mismatch can cause the evidence to be invalid, upon which the node producing the evidence will be asked to generate a new evidence. This new evidence will be the same, which means it will again be rejected by other nodes involved in the consensus. This loop will continue until the peer nodes decide to disconnect from the node producing the evidence.
如何修補 CVE-2021-21271
要修補 CVE-2021-21271,請將受影響套件升級到下列已修補版本。
- —升級至 0.34.3 或更新版本
CVE-2021-21271 正在被利用嗎?
低 — EPSS 為 1.7%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 0.34.0, < 0.34.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |