GO-2024-2951
- Source
- https://pkg.go.dev/vuln/GO-2024-2951
- Import Source
- https://vuln.go.dev/ID/GO-2024-2951.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2024-2951
- Aliases
- Published
- 2024-07-02T17:39:03Z
- Modified
- 2024-07-02T18:12:57Z
- Summary
- Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft
- Details
-
A malicious peer can cause a syncing node to panic during blocksync. The syncing node may enter into a catastrophic invalid syncing state or get stuck in blocksync mode, never switching to consensus. Nodes that are vulnerable to this state may experience a Denial of Service condition in which syncing will not work as expected when joining a network as a client.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2024-2951" }- References
- Credits
-
-
- unknown_feature
-
Affected packages
Go / github.com/cometbft/cometbft
Package
- Name
- github.com/cometbft/cometbft
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/cometbft/cometbft
Ecosystem specific
{
"imports": [
{
"path": "github.com/cometbft/cometbft/blocksync",
"symbols": [
"BlockPool.OnStart",
"BlockPool.RedoRequest",
"BlockPool.RemovePeerAndRedoAllPeerRequests",
"BlockPool.SetPeerRange",
"BlockPool.removeTimedoutPeers",
"NewBlockPool",
"NewReactor",
"Reactor.OnStart",
"Reactor.Receive",
"Reactor.SwitchToBlockSync"
]
}
]
}