CVE-2020-15091: Denial of Service in github.com/tendermint/tendermint
Summary
CVE-2020-15091: Denial of service in github.com/tendermint/tendermint. Affects github.com/tendermint/tendermint versions >= 0.33.0, < 0.34.0-dev1.0.20200702134149-480b995a3172. Fixed in 0.34.0-dev1.0.20200702134149-480b995a3172. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/tendermint/tendermint, which is written in Go. Tendermint is a Byzantine Fault Tolerant (BFT) consensus engine that is used in blockchain applications. It provides a secure and efficient consensus algorithm for validating transactions and maintaining the integrity of the blockchain. This vulnerability affects versions 0.33.0 and earlier of the package.
Vulnerability Detail
The vulnerability (CVE-2020-15091) arises from proposed commits containing signatures for blocks that are not included in the commit. Instead of skipping these signatures, they cause failure during verification. This can be exploited by a malicious proposer to force consensus failures. The impact of this vulnerability is that it can disrupt the consensus process in blockchain applications that rely on Tendermint, leading to potential denial of service attacks.
How To Fix
Minimum fixed version
0.34.0-dev1.0.20200702134149-480b995a3172
This is the first release that contains the fix.
go get github.com/tendermint/tendermint@v0.34.0-dev1.0.20200702134149-480b995a3172Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above.
Conclusion
In conclusion, the vulnerability (CVE-2020-15091) in github.com/tendermint/tendermint can be exploited to force consensus failures in blockchain applications. It is recommended to upgrade to the fixed version to mitigate the risk of denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tendermint/tendermint →
FAQ
Tendermint is a Byzantine Fault Tolerant (BFT) consensus engine used in blockchain applications.
The vulnerability can be exploited to force consensus failures, potentially leading to denial of service attacks in blockchain applications.
Versions 0.33.0 and earlier are affected.
No, there is no known workaround. It is recommended to upgrade to the fixed version.
To fix this vulnerability, upgrade to version 0.34.0-dev1.0.20200702134149-480b995a3172 or later of the github.com/tendermint/tendermint package.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tendermint/tendermint.
