PT-2020-13275 · Gossipsub · Gossipsub

Published 2020-07-07 · Updated 2020-07-15 · CVE-2020-12821

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gossipsub version 1.0

Description The issue concerns Gossipsub 1.0's inability to properly resist invalid message spam. This includes susceptibility to an eclipse attack or a sybil attack.

Recommendations For Gossipsub version 1.0, consider implementing additional measures to resist invalid message spam, such as enhancing spam detection mechanisms or limiting the impact of sybil and eclipse attacks, until a more robust solution is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-12821

Affected Products

Gossipsub

References · 9

• 🔥 https://gateway.ipfs.io/ipfs/QmPWuNBs8h6a8KamRvGqhTq5UDYJRQsEEy37zDKjujQQQm/Gossipsub%20Evaluation%20Report.pdf · Exploit
• https://github.com/ipfs/blog/pull/450 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-12821 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12821 · Vendor Advisory
• https://github.com/libp2p/specs/tree/master/pubsub/gossipsub · Note
• https://github.com/libp2p/specs/blob/master/pubsub/gossipsub/gossipsub-v1.1.md · Note
• https://t.me/cibsecurity/13314 · Telegram Post
• https://t.me/cvenotify/4941 · Telegram Post
• https://bitcoin.stackexchange.com/questions/61151/eclipse-attack-vs-sybil-attack · Note