GHSA-FJ2X-735W-74VQ vulnerabilities

Vulnerabilities for packages: op-geth...

GHSA-FJ2X-735W-74VQ vulnerabilities

Vulnerabilities for packages: op-geth...

EUVD-2021-1427

Malware in sbrugna...

EUVD-2021-1345

Malware in sbrugna...

EUVD-2021-1389

Malware in sbrugna...

EUVD-2021-1406

Malware in sbrugna...

EUVD-2023-2566

Malicious code in bioql PyPI...

EUVD-2023-2817

Malicious code in bioql PyPI...

CVE-2023-42319

Geth aka go-ethereum through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service memory consumption and daemon hang via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand attacks by hostile client...

CVE-2022-23328

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

CVE-2020-26265

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where vulnerable versions refuse to accept the canonical chain. The fix was included in the Paragade...

CVE-2020-26264

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly...

Go Ethereum vulnerable to DoS via malicious p2p message

Impact A vulnerable node can be forced to shutdown/crash using a specially crafted message. During the peer-to-peer connection handshake, a shared secret key is computed. The implementation did not verify whether the EC public key provided by the remote party is a valid point on the secp256k1...

Consensus Attack

github.com/ethereum/go-ethereum is vulnerable to a Consensus Attack. The vulnerability is due to Geth's pre-compiled dataCopy contract performing a shallow copy on invocation, which allows an attacker to manipulate Ethereum Virtual Machine EVM memory and cause a consensus mismatch between nodes...

GO-2022-0771 Shallow copy bug in geth in github.com/ethereum/go-ethereum

Shallow copy bug in geth in github.com/ethereum/go-ethereum...

GO-2022-0775 Erroneous Proof of Work calculation in geth in github.com/ethereum/go-ethereum

Erroneous Proof of Work calculation in geth in github.com/ethereum/go-ethereum...

Malicious code in Nеthеreսm.Gеth (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Resource Exhaustion

go-ethereum geth is vulnerable to a Resource Exhaustion. The vulnerability is due to a lack of proper handling of specially crafted p2p messages sent from an attacker node, causing vulnerable nodes to consume excessive amounts of memory...

GHSA-4XC9-8HMQ-J652 go-ethereum vulnerable to DoS via malicious p2p message

Impact A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. In order to carry out the attack, the attacker establishes a peer connections to the victim, and sends a malicious GetBlockHeadersRequest message...

go-ethereum vulnerable to denial of service via crafted GraphQL query

Geth aka go-ethereum through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service memory consumption and daemon hang via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand attacks by hostile client...