PT-2022-23149 · Elrond · Elrond-Go

Iulianpascalau · Published 2022-09-01 · Updated 2024-08-21 · CVE-2022-36058

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions elrond-go versions prior to 1.3.34

Description The issue affects elrond-go, the go implementation for the Elrond Network protocol. In affected versions, processing blocks that contain a MultiESDTNFTTransfer transaction with a missing function name could cause problems. Basic functionality like p2p messaging, storage, and API requests are unaffected.

Recommendations For versions prior to 1.3.34, update to version 1.3.34 or higher to resolve the issue. As a temporary workaround, consider avoiding the processing of blocks that contain MultiESDTNFTTransfer transactions with missing function names until a patch is applied. No other workarounds are available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-36058

GHSA-QF7J-25G9-R63F

GO-2022-0970

Affected Products

Elrond-Go

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36058.json · Exploit
• 🔥 https://github.com/ElrondNetwork/elrond-go/security/advisories/GHSA-qf7j-25g9-r63f · Exploit
• https://github.com/ElrondNetwork/elrond-go/commit/cb487fd7be2a2077638eb34ae771a73630c870c7 · Patch
• https://osv.dev/vulnerability/GHSA-qf7j-25g9-r63f · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36058 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36058 · Vendor Advisory
• https://github.com/ElrondNetwork/elrond-go · Note
• https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L402 · Note
• https://t.me/cibsecurity/49385 · Telegram Post