{"id":"CVE-2020-26264","published":"2020-12-11T16:45:24Z","modified":"2024-08-04T15:56:04Z","title":"LES Server DoS via GetProofsV2","vendor":"ethereum","product":"go-ethereum","tier":"tail","description":{"text":"Go Ethereum, or \"Geth\", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01886,"percentile":0.79456,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29q","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ethereum/go-ethereum/pull/21896","tags":["x_refsource_MISC"]},{"url":"https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46","tags":["x_refsource_MISC"]},{"url":"https://github.com/ethereum/go-ethereum/releases/tag/v1.9.25","tags":["x_refsource_MISC"]}],"priority":{"score":20.4,"factors":[{"name":"EPSS percentile","points":15.89},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"ethereum","affectedVersions":[{"vendor":"ethereum","product":"go-ethereum","versions":["< 1.9.25"]}],"affected":[{"ecosystem":"Go","package":"github.com/ethereum/go-ethereum","vulnerableRanges":["<1.9.25"],"patched":["1.9.25"],"from":["GHSA-r33q-22hv-j29q","GO-2021-0063"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1389","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ethereum-go-ethereum-cve-2018-19184","children":[{"from":"CVE-2020-26264","to":"CVE-2020-26265","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["les/server_handler.go"],"commits":["https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46","https://github.com/ethereum/go-ethereum/commit/87c0ba92136a75db0ab2aba1046d4a9860375d6a"],"basis":"shared function","functions":["handleMsg"]}]}],"packageHistory":[{"cve":"CVE-2020-26242","published":"2020-11-25","fixed":"1.9.18","kev":false},{"cve":"CVE-2020-26265","published":"2020-12-11","fixed":"1.9.20","kev":false},{"cve":"CVE-2020-26240","published":"2020-11-25","fixed":"1.9.24","kev":false,"link":{"from":"CVE-2020-26240","to":"CVE-2020-26264","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/ethereum/go-ethereum","fromFixed":"1.9.24","toFixed":"1.9.25","daysApart":16}]}},{"cve":"CVE-2020-26264","published":"2020-12-11","fixed":"1.9.25","kev":false},{"cve":"CVE-2021-39137","published":"2021-08-24","fixed":"1.10.8","kev":false,"link":{"from":"CVE-2020-26264","to":"CVE-2021-39137","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/ethereum/go-ethereum","fromFixed":"1.9.25","toFixed":"1.10.8","daysApart":256}]}},{"cve":"CVE-2021-41173","published":"2021-10-26","fixed":"1.10.9","kev":false},{"cve":"CVE-2022-29177","published":"2022-05-20","fixed":"1.10.17","kev":false}],"package":"Go:github.com/ethereum/go-ethereum"}}