PT-2023-28592 · Cardano · Hydra

Jmhrpr

·

Publicado

2023-09-21

·

Atualizado

2023-10-03

·

CVE-2023-42806

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions Hydra versions prior to 0.13.0
Description Hydra is the layer-two scalability solution for Cardano. Not signing and verifying cid allows an attacker, who must be a participant of this head, to use a snapshot from an old head instance with the same participants to close the head or contest the state with it. This can lead to an incorrect distribution of value, resulting in a value extraction attack, or prevent the head from finalizing due to inconsistent value availability, causing a denial of service.
Recommendations For versions prior to 0.13.0, as a temporary workaround, consider rotating keys between heads to avoid reusing keys and resulting in the same multi-signature participants. A patch is planned for version 0.13.0.

Exploit

Correção

Improper Verification of Cryptographic Signature

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2023-42806
GHSA-GR36-MC6V-72QQ

Produtos afetados

Hydra