CVE-2018-16733: Improper Input Validation in github.com/ethereum/go-ethereum/eth
Summary
CVE-2018-16733: Go Ethereum Improper Input Validation. Affects github.com/ethereum/go-ethereum versions < 1.8.14. Fixed in 1.8.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/ethereum/go-ethereum/eth is part of the Go Ethereum (geth) project. It is a client implementation of the Ethereum protocol in the Go programming language. The package provides functionality for interacting with the Ethereum blockchain. However, it is vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability (CVE-2018-16733) exists in the TraceChain function in the eth/api_tracer.go file of the go-ethereum/eth package. It fails to properly validate the input, specifically the end block, against the start block. This oversight allows an attacker to specify an end block that is before the start block, potentially leading to unexpected behavior or exploitation of the Ethereum blockchain.
How To Fix
Minimum fixed version
1.8.14
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.8.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package.
Conclusion
In conclusion, the go-ethereum/eth package is vulnerable to an improper input validation issue that can potentially lead to unexpected behavior or exploitation of the Ethereum blockchain. It is crucial to update to version 1.8.14 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
The vulnerability can potentially lead to unexpected behavior or exploitation of the Ethereum blockchain.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 7.5.
There are no known instances of this vulnerability being exploited at this time.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-qr2j-wrhx-4829/GHSA-qr2j-wrhx-4829.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
