{"id":"CVE-2021-39137","published":"2021-08-24T16:05:10Z","modified":"2024-08-04T01:58:17Z","title":"Consensus flaw during block processing in go-ethereum","vendor":"ethereum","product":"go-ethereum","tier":"tail","description":{"text":"go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming `v1.10.8` release. No workaround are available.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01325,"percentile":0.70886,"provenance":"source"},"cwes":[{"id":"CWE-436","name":"Interpretation Conflict"}],"references":[{"url":"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ethereum/go-ethereum/releases/tag/v1.10.8","tags":["x_refsource_MISC"]}],"priority":{"score":18.7,"factors":[{"name":"EPSS percentile","points":14.18},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"ethereum","affectedVersions":[{"vendor":"ethereum","product":"go-ethereum","versions":[">= 1.10.0, < 1.10.8"]}],"affected":[{"ecosystem":"Go","package":"github.com/ethereum/go-ethereum","vulnerableRanges":[">=1.10.0, <1.10.8","<1.10.8"],"patched":["1.10.8"],"from":["GHSA-9856-9gg9-qcmq","GO-2022-0254"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1653","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ethereum-go-ethereum-cve-2018-19184","parents":[{"from":"CVE-2020-26241","to":"CVE-2021-39137","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/vm/instructions.go","core/vm/interpreter.go"],"commits":["https://github.com/ethereum/go-ethereum/commit/295693759e5ded05fec0b2fb39359965b60da785","https://github.com/ethereum/go-ethereum/commit/4d4879cafd1b3c906fc184a8c4a357137465128f"],"basis":"shared function","functions":["Run","opCall","opCallCode"]}]}],"packageHistory":[{"cve":"CVE-2020-26265","published":"2020-12-11","fixed":"1.9.20","kev":false},{"cve":"CVE-2020-26240","published":"2020-11-25","fixed":"1.9.24","kev":false},{"cve":"CVE-2020-26264","published":"2020-12-11","fixed":"1.9.25","kev":false,"link":{"from":"CVE-2020-26264","to":"CVE-2021-39137","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/ethereum/go-ethereum","fromFixed":"1.9.25","toFixed":"1.10.8","daysApart":256}]}},{"cve":"CVE-2021-39137","published":"2021-08-24","fixed":"1.10.8","kev":false},{"cve":"CVE-2021-41173","published":"2021-10-26","fixed":"1.10.9","kev":false,"link":{"from":"CVE-2021-39137","to":"CVE-2021-41173","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/ethereum/go-ethereum","fromFixed":"1.10.8","toFixed":"1.10.9","daysApart":63}]}},{"cve":"CVE-2022-29177","published":"2022-05-20","fixed":"1.10.17","kev":false},{"cve":"CVE-2023-40591","published":"2023-09-06","fixed":"1.12.1-stable","kev":false}],"package":"Go:github.com/ethereum/go-ethereum"}}