PT-2021-23900 · Unknown · Go-Ethereum

Published 2021-11-18 · Updated 2021-11-23 · CVE-2021-43668

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Go-Ethereum version 1.10.9

Description: The issue causes Go-Ethereum nodes to crash, resulting in a denial of service, after receiving a series of messages. The crash occurs due to a runtime error, specifically an invalid memory address or nil pointer dereference, which triggers a SEGV signal.

Recommendations: For Go-Ethereum version 1.10.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-43668

GHSA-5M8F-CHRV-7RW5

Affected Products

Go-Ethereum

References · 9

• https://cve.org/CVERecord?id=CVE-2021-43668 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43668 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-43668 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5m8f-chrv-7rw5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43668 · Vendor Advisory
• https://github.com/ethereum/go-ethereum/issues/23866 · Note
• https://github.com/ethereum/go-ethereum · Note
• https://github.com/syndtr/goleveldb/issues/373 · Note