CVE-2020-26265: Incorrect Calculation

June 29, 2021

Go Ethereum, or “Geth”, is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where vulnerable versions refuse to accept the canonical chain. The fix was included in the Paragade release version 1.9.20. No individual workaround patches have been made – all users are recommended to upgrade to a newer version.

References

github.com/advisories/GHSA-xw37-57qp-9mm4
github.com/ethereum/go-ethereum/pull/21409
github.com/ethereum/go-ethereum/releases/tag/v1.9.20
github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4
nvd.nist.gov/vuln/detail/CVE-2020-26265

Code Behaviors & Features

Detect and mitigate CVE-2020-26265 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →