Security Digest · Critical advisory (no CVE assigned)
GHSA-82vg-5v4f-f9wq: Namada-apps can Crash with Excessive Computation in Mempool Validation
Impact A malicious transaction may cause a crash in mempool validation.
CVSS 9.2 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
cargo audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| crates.io (Rust) | namada-apps | = 1.0.0 | 1.1.0 |
Details
Impact
A malicious transaction may cause a crash in mempool validation.
A transaction with authorization section containing 256 public keys or more with valid matching signatures triggers an integer overflow in signature verification that causes a the node to panic.
Patches
This issue has been patched in apps version 1.1.0. The mempool validation has been fixed to avoid overflow.
Workarounds
There are no workarounds and users are advised to upgrade.
CVSS: 9.2 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Sources and references
- GitHub Advisory GHSA-82vg-5v4f-f9wq github.com
- github.com github.com
Critical crates.io (Rust) advisories · Today’s Security Digest