Vulnerability GHSA-h4c3-5275-vrmg
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 years ago
February 03, 2024 at 12:29 AM UTC
Nervos CKB Pool does not remove the conflicting transactions from the statistics
0.1.0 - 0.39.1
0.1.0 - 0.39.1
Summary
Nervos CKB Pool does not remove the conflicting transactions from the statistics
Details
Impact
There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions.
Patches
0.39.2
Workarounds
Restart the CKB node.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 years ago
Nervos CKB Permit load cell data from memory
0.37.0 - 0.38.0 GHSA-29c2-65rj-h343
0.37.0 - 0.38.0 GHSA-29c2-65rj-h343
Critical
2 years ago
Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result
0.1.0 GHSA-q73f-w3h7-7wcc
0.1.0 GHSA-q73f-w3h7-7wcc
High Risk
2 years ago
Nervos CKB Snappy decompress length can be very large and causes out of memory error
0.1.0 GHSA-3gjh-29fv-8hr6
0.1.0 GHSA-3gjh-29fv-8hr6
High Risk
2 years ago
Nervos CKB Panic on malformed input
0.1.0 GHSA-wjxc-pjx9-4wvm
0.1.0 GHSA-wjxc-pjx9-4wvm
High Risk
2 years ago
Nervos CKB node panics when processing a block which parent timestamp is too new
>=0.33.0 <0.33.2, >=0.34.0 <0.34.1 GHSA-hjqq-29pw-96wj
>=0.33.0 <0.33.2, >=0.34.0 <0.34.1 GHSA-hjqq-29pw-96wj
Impacted packages
Timeline
Published
2 years ago
February 03, 2024 at 12:29 AM UTC
Last Modified
2 years ago
February 03, 2024 at 12:29 AM UTC