GO-2024-2831

See a problem?
Source
https://pkg.go.dev/vuln/GO-2024-2831
Import Source
https://vuln.go.dev/ID/GO-2024-2831.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2024-2831
Aliases
Published
2024-05-14T16:33:28Z
Modified
2024-05-20T16:03:47Z
Summary
ATX protocol validation problem in github.com/spacemeshos/go-spacemesh
Details

Nodes can publish ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule.

References

Affected packages

Go / github.com/spacemeshos/api/release/go

Package

Name
github.com/spacemeshos/api/release/go
View open source insights on deps.dev
Purl
pkg:golang/github.com/spacemeshos/api/release/go

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.37.1

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/spacemeshos/api/release/go/spacemesh/v1"
        }
    ]
}

Go / github.com/spacemeshos/go-spacemesh

Package

Name
github.com/spacemeshos/go-spacemesh
View open source insights on deps.dev
Purl
pkg:golang/github.com/spacemeshos/go-spacemesh

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.2-hotfix1

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/spacemeshos/go-spacemesh/activation",
            "symbols": [
                "Handler.HandleGossipAtx",
                "Handler.SyntacticallyValidateDeps",
                "Handler.processATX",
                "Handler.storeAtx"
            ]
        },
        {
            "path": "github.com/spacemeshos/go-spacemesh/events",
            "symbols": [
                "CloseEventReporter",
                "EmitAtxPublished",
                "EmitBeacon",
                "EmitEligibilities",
                "EmitInitComplete",
                "EmitInitFailure",
                "EmitInitStart",
                "EmitInvalidPostProof",
                "EmitOwnMalfeasanceProof",
                "EmitPoetWaitProof",
                "EmitPoetWaitRound",
                "EmitPostComplete",
                "EmitPostFailure",
                "EmitPostServiceStarted",
                "EmitPostServiceStopped",
                "EmitPostStart",
                "EmitProposal",
                "InitializeReporter",
                "LayerUpdate.Field",
                "ReportAccountUpdate",
                "ReportError",
                "ReportLayerUpdate",
                "ReportMalfeasance",
                "ReportNewActivation",
                "ReportNewTx",
                "ReportNodeStatusUpdate",
                "ReportProposal",
                "ReportResult",
                "ReportRewardReceived",
                "ReportTxWithValidity",
                "SubcribeProposals",
                "Subscribe",
                "SubscribeAccount",
                "SubscribeActivations",
                "SubscribeErrors",
                "SubscribeLayers",
                "SubscribeMalfeasance",
                "SubscribeMatched",
                "SubscribeRewards",
                "SubscribeStatus",
                "SubscribeToLayers",
                "SubscribeTxs",
                "SubscribeUserEvents",
                "ToMalfeasancePB"
            ]
        },
        {
            "path": "github.com/spacemeshos/go-spacemesh/malfeasance",
            "symbols": [
                "Handler.HandleSyncedMalfeasanceProof",
                "Validate"
            ]
        },
        {
            "path": "github.com/spacemeshos/go-spacemesh/malfeasance/wire",
            "symbols": [
                "AtxProof.DecodeScale",
                "AtxProof.MarshalLogObject",
                "AtxProofMsg.DecodeScale",
                "AtxProofMsg.SignedBytes",
                "BallotProof.DecodeScale",
                "BallotProof.MarshalLogObject",
                "BallotProofMsg.DecodeScale",
                "BallotProofMsg.SignedBytes",
                "HareMetadata.DecodeScale",
                "HareMetadata.ToBytes",
                "HareProof.DecodeScale",
                "HareProof.MarshalLogObject",
                "HareProofMsg.DecodeScale",
                "HareProofMsg.SignedBytes",
                "InvalidPostIndexProof.DecodeScale",
                "InvalidPostIndexProof.EncodeScale",
                "MalfeasanceGossip.DecodeScale",
                "MalfeasanceGossip.EncodeScale",
                "MalfeasanceInfo",
                "MalfeasanceProof.DecodeScale",
                "MalfeasanceProof.EncodeScale",
                "MalfeasanceProof.MarshalLogObject",
                "Proof.DecodeScale",
                "Proof.EncodeScale"
            ]
        },
        {
            "path": "github.com/spacemeshos/go-spacemesh/node",
            "symbols": [
                "App.setupDBs",
                "App.verifyDB"
            ]
        },
        {
            "path": "github.com/spacemeshos/go-spacemesh/sql/atxs",
            "symbols": [
                "Add",
                "AddGettingNonce",
                "IterateIDsByEpoch"
            ]
        }
    ]
}