VDB
CVE-2020-26240
CVE-2020-26240
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published November 25, 2020
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ethereum | go-ethereum | < 1.9.24 |
| github.com | ethereum/go-ethereum/cmd/evm | 0, 0, 0 |
| github.com | ethereum/go-ethereum | 0, 0, 0 |
| github.com | ethereum/go-ethereum/eth | 0, 0, 0 |
| github.com | ethereum/go-ethereum/consensus | 0, 0, 0 |
| ethereum | go-ethereum | < 1.9.24, < 1.9.24, < 1.9.24 |
Timeline
- Nov 25, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
References
- x_refsource_MISC
- x_refsource_CONFIRM
- x_refsource_MISC
- x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2020-26240 advisory
- https://github.com/advisories/GHSA-v592-xf75-856p advisory
- https://blog.ethereum.org/2020/11/12/geth_security_release url
- https://github.com/ethereum/go-ethereum url