erroneo.us
Search all guides⌘K

Security Digest · Critical advisory (no CVE assigned)

GHSA-q73f-w3h7-7wcc: Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result

Impact Tx-pool verify transaction which inputs' script contains loadcelldatahash is nondeterministic Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none.

GitHub-reviewed · critical

Published By erroneo.us Security DeskSeen in the digest for Feb 2, 2024

Should you act?

  • Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with cargo audit.
  • No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

EcosystemPackageVulnerableFirst fixed
crates.io (Rust)ckb<= 0.34.10.34.2

Details

Impact Tx-pool verify transaction which inputs' script contains loadcelldatahash is nondeterministic

Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none.

Sources and references

  1. GitHub Advisory GHSA-q73f-w3h7-7wcc github.com
  2. github.com github.com
  3. github.com github.com
  4. github.com github.com
  5. github.com github.com

Critical crates.io (Rust) advisories · Today’s Security Digest