GHSA-m9c9-mc2h-9wjw: Lodestar snappy checksum issue

January 14, 2025

Unintended permanent chain split affecting greater than or equal to 25% of the network, requiring hard fork (network partition requiring hard fork)

Lodestar does not verify checksum in snappy framing uncompressed chunks.

References

github.com/ChainSafe/lodestar
github.com/ChainSafe/lodestar/commit/18a0d681dbcc51fb2ac9456f31e91f4e31a18300
github.com/ChainSafe/lodestar/security/advisories/GHSA-m9c9-mc2h-9wjw
github.com/advisories/GHSA-m9c9-mc2h-9wjw

Code Behaviors & Features

Detect and mitigate GHSA-m9c9-mc2h-9wjw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →