CVE-2021-21271
MEDIUM6.5EPSS 0.38%Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint
發布日:2022/10/7修改日:2024/5/20
描述
Mishandling of timestamps during consensus process can cause a denial of service. While reaching consensus, different tendermint nodes can observe a different timestamp for a consensus evidence. This mismatch can cause the evidence to be invalid, upon which the node producing the evidence will be asked to generate a new evidence. This new evidence will be the same, which means it will again be rejected by other nodes involved in the consensus. This loop will continue until the peer nodes decide to disconnect from the node producing the evidence.
受影響套件(2)
- Go/github.com/tendermint/tendermint>= 0.34.0, < 0.34.3
- Go/github.com/tendermint/tendermint>= 0.34.0, < 0.34.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
參考連結(7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-21271
- PATCHhttps://github.com/tendermint/tendermint
- WEBhttps://github.com/tendermint/tendermint/blob/v0.34.3/CHANGELOG.md#v0.34.3
- WEBhttps://github.com/tendermint/tendermint/commit/a2a6852ab99e4a0f9e79f0ea8c1726e262e25c76
- WEBhttps://github.com/tendermint/tendermint/pull/5219
- WEBhttps://github.com/tendermint/tendermint/security/advisories/GHSA-p658-8693-mhvg
- WEBhttps://pkg.go.dev/vuln/GO-2022-1052