CVE-2021-39137: Interpretation Conflict
(updated )
go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming v1.10.8 release. No workaround are available.
References
- github.com/advisories/GHSA-9856-9gg9-qcmq
- github.com/ethereum/go-ethereum/pull/23381/commits/4d4879cafd1b3c906fc184a8c4a357137465128f
- github.com/ethereum/go-ethereum/releases/tag/v1.10.8
- github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq
- nvd.nist.gov/vuln/detail/CVE-2021-39137
- pkg.go.dev/vuln/GO-2022-0254
Code Behaviors & Features
Detect and mitigate CVE-2021-39137 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →