CVE-2019-25072: Tendermint Client package vulnerable to Uncontrolled Resource Consumption

December 28, 2022 (updated December 30, 2022)

Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.

References

github.com/advisories/GHSA-3fm3-m23v-5r46
github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613
github.com/tendermint/tendermint/pull/3430
nvd.nist.gov/vuln/detail/CVE-2019-25072
pkg.go.dev/vuln/GO-2020-0037

Code Behaviors & Features

Detect and mitigate CVE-2019-25072 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →