CVE-2021-41173

Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside from upgrading.

CVSS v3 5.7 MEDIUM
CVSS v2.0 3.5 LOW

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:N/A:P

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/ethereum/go-ethereum/commit/e40b37718326b8b4873b3b00a0db2e6c6d9ea738	Patch Third Party Advisory
https://github.com/ethereum/go-ethereum/pull/23801	Patch Third Party Advisory
https://github.com/ethereum/go-ethereum/releases/tag/v1.10.9	Release Notes Third Party Advisory
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v	Third Party Advisory
https://github.com/ethereum/go-ethereum/commit/e40b37718326b8b4873b3b00a0db2e6c6d9ea738	Patch Third Party Advisory
https://github.com/ethereum/go-ethereum/pull/23801	Patch Third Party Advisory
https://github.com/ethereum/go-ethereum/releases/tag/v1.10.9	Release Notes Third Party Advisory
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-10-26 14:15

Updated : 2024-11-21 06:25

NVD link : CVE-2021-41173

Mitre link : CVE-2021-41173

CVE.ORG link : CVE-2021-41173

JSON object : View

Products Affected

ethereum

go_ethereum

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2021-41173", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "published": "2021-10-26T14:15:08.130", "references": [{"url": "https://github.com/ethereum/go-ethereum/commit/e40b37718326b8b4873b3b00a0db2e6c6d9ea738", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ethereum/go-ethereum/pull/23801", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ethereum/go-ethereum/releases/tag/v1.10.9", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ethereum/go-ethereum/commit/e40b37718326b8b4873b3b00a0db2e6c6d9ea738", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ethereum/go-ethereum/pull/23801", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ethereum/go-ethereum/releases/tag/v1.10.9", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside from upgrading."}, {"lang": "es", "value": "Go Ethereum es la implementaci\u00f3n oficial en Golang del protocolo Ethereum. En versiones anteriores a 1.10.9, un nodo vulnerable es susceptible de bloquearse cuando procesa un mensaje maliciosamente dise\u00f1ado de un compa\u00f1ero. La versi\u00f3n v1.10.9 contiene parches para la vulnerabilidad. No se conocen soluciones aparte de la actualizaci\u00f3n"}], "lastModified": "2024-11-21T06:25:40.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA383AD6-A083-453C-BED8-C2C8BCCDEEDE", "versionEndExcluding": "1.10.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}