Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vulnerabilities: update for CVE-2021-39137 #23446

Merged
merged 2 commits into from
Aug 24, 2021
Merged

vulnerabilities: update for CVE-2021-39137 #23446

merged 2 commits into from
Aug 24, 2021

Conversation

holiman
Copy link
Contributor

@holiman holiman commented Aug 24, 2021 •
edited
Loading

This PR updates the version-check to include info about the latest patch.

[user@work go-ethereum]$ geth version-check --check.url file:///tmp/vulnerabilities.json
INFO [08-24|09:34:03.423] Checking vulnerabilities                 version=Geth/v1.10.7-unstable-e3e0ce00-20210818/linux-amd64/go1.16.4 url=file:///tmp/vulnerabilities.json
## Vulnerable to GETH-2021-02 ( EVM flaw during block processing )

Severity: High
Summary : A vulnerability in the Geth EVM could cause a node to no longer being able to process the chain. Further details about the vulnerability will be disclosed at a later date.
Fixed in: v1.10.8
CVE: CVE-2021-39137
References:
	- https://github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq
	- https://github.com/ethereum/go-ethereum/releases/tag/v1.10.8

@holiman holiman changed the title vulnerabilities: update vulnerabilities: update for CVE-2021-39137 Aug 24, 2021
MariusVanDerWijden
MariusVanDerWijden reviewed Aug 24, 2021
View reviewed changes
docs/_vulnerabilities/vulnerabilities.json
@@ -112,8 +112,24 @@
],
"introduced": "v1.10.1",
"fixed": "v1.10.6",
"published": "2020-12-10",
"published": "2020-07-22",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2021?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, damnit, now I have to do the whole signing-dance again.. except felix merged it, so I guess we'll update it next time :)

MariusVanDerWijden
MariusVanDerWijden approved these changes Aug 24, 2021
View reviewed changes
Copy link
Member

@MariusVanDerWijden MariusVanDerWijden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fjl fjl merged commit ed90fb7 into ethereum:gh-pages Aug 24, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@MariusVanDerWijden MariusVanDerWijden MariusVanDerWijden approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@holiman @MariusVanDerWijden @fjl