{"id":"CVE-2020-26265","published":"2020-12-11T16:45:15Z","modified":"2024-08-04T15:56:03Z","title":"Consensus flaw during block processing","vendor":"ethereum","product":"go-ethereum","tier":"tail","description":{"text":"Go Ethereum, or \"Geth\", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where vulnerable versions refuse to accept the canonical chain. The fix was included in the Paragade release version 1.9.20. No individual workaround patches have been made -- all users are recommended to upgrade to a newer version.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0092,"percentile":0.60243,"provenance":"source"},"cwes":[{"id":"CWE-682","name":"Incorrect Calculation"}],"references":[{"url":"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ethereum/go-ethereum/releases/tag/v1.9.20","tags":["x_refsource_MISC"]}],"priority":{"score":15.8,"factors":[{"name":"EPSS percentile","points":12.05},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"ethereum","affectedVersions":[{"vendor":"ethereum","product":"go-ethereum","versions":[">= 1.9.4, < 1.9.20"]}],"affected":[{"ecosystem":"Go","package":"github.com/ethereum/go-ethereum","vulnerableRanges":[">=1.9.4, <1.9.20"],"patched":["1.9.20"],"from":["GHSA-xw37-57qp-9mm4","GO-2021-0105"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1427","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ethereum-go-ethereum-cve-2018-19184","parents":[{"from":"CVE-2020-26241","to":"CVE-2020-26265","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/state/statedb.go","trie/secure_trie.go"],"commits":["https://github.com/ethereum/go-ethereum/commit/295693759e5ded05fec0b2fb39359965b60da785","https://github.com/ethereum/go-ethereum/commit/87c0ba92136a75db0ab2aba1046d4a9860375d6a"],"basis":"rarely changed file"}]},{"from":"CVE-2020-26264","to":"CVE-2020-26265","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["les/server_handler.go"],"commits":["https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46","https://github.com/ethereum/go-ethereum/commit/87c0ba92136a75db0ab2aba1046d4a9860375d6a"],"basis":"shared function","functions":["handleMsg"]}]}],"children":[{"from":"CVE-2020-26265","to":"CVE-2021-41173","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["trie/trie.go"],"commits":["https://github.com/ethereum/go-ethereum/commit/87c0ba92136a75db0ab2aba1046d4a9860375d6a","https://github.com/ethereum/go-ethereum/commit/e40b37718326b8b4873b3b00a0db2e6c6d9ea738","https://github.com/ethereum/go-ethereum/commit/f1fd963a5a965e643e52fcf805a2a02a323c32b8"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2018-19184","published":"2018-11-12","fixed":"1.8.14","kev":false},{"cve":"CVE-2020-26241","published":"2020-11-25","fixed":"1.9.17","kev":false},{"cve":"CVE-2020-26242","published":"2020-11-25","fixed":"1.9.18","kev":false,"link":{"from":"CVE-2020-26242","to":"CVE-2020-26265","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/ethereum/go-ethereum","fromFixed":"1.9.18","toFixed":"1.9.20","daysApart":16}]}},{"cve":"CVE-2020-26265","published":"2020-12-11","fixed":"1.9.20","kev":false},{"cve":"CVE-2020-26240","published":"2020-11-25","fixed":"1.9.24","kev":false},{"cve":"CVE-2020-26264","published":"2020-12-11","fixed":"1.9.25","kev":false},{"cve":"CVE-2021-39137","published":"2021-08-24","fixed":"1.10.8","kev":false}],"package":"Go:github.com/ethereum/go-ethereum"}}