Lucene search

K
osvGoogleOSV:CVE-2023-33964
HistoryMay 31, 2023 - 6:15 p.m.

CVE-2023-33964

2023-05-3118:15:09
Google
osv.dev
3
mx-chain-go
multiversx blockchain
go language
metachain
invalid transaction
notarizing blocks
patched binary version
security issue

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

35.5%

mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces processIfTxErrorCrossShard for the metachain transaction processor. There are no known workarounds for this issue.

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

35.5%

Related for OSV:CVE-2023-33964