CVE-2018-19183: Denial of Service in ethereumjs-vm
Summary
CVE-2018-19183: Denial of Service in ethereumjs-vm. Affects ethereumjs-vm versions < 2.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ethereumjs-vm is an npm package that provides a virtual machine implementation for the Ethereum blockchain. It allows developers to execute Ethereum smart contracts in a sandboxed environment. The package is widely used in Ethereum-based applications and platforms. However, version 2.4.0 of ethereumjs-vm is vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in ethereumjs-vm 2.4.0 allows attackers to cause a DoS by exploiting a failure in the 'vm.runCode' function. By providing a specific 'code' attribute, constructed using 'Buffer.from(my_code, 'hex')', an attacker can trigger a failure and force the virtual machine to REVERT. This can lead to the disruption of the Ethereum network and impact the availability of affected applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the latest secure version as soon as possible.
Conclusion
The vulnerability in ethereumjs-vm 2.4.0 can be exploited to cause a DoS attack. To protect your application and the Ethereum network, it is crucial to update the package to version 2.4.1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ethereumjs-vm →
FAQ
ethereumjs-vm is an npm package that provides a virtual machine implementation for executing Ethereum smart contracts.
The vulnerability allows attackers to cause a DoS, potentially disrupting the Ethereum network and impacting affected applications.
To fix this vulnerability, update the ethereumjs-vm package to version 2.4.1 or later.
No, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
For more information, refer to the GitHub Security Advisory GHSA-2mw7-wggm-m6w3.
