VDB
CVE-2020-26240
CVE-2020-26240
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published November 25, 2020
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ethereum | go-ethereum | < 1.9.24 |
| github.com | ethereum/go-ethereum/cmd/evm | 0, 0 |
| github.com | ethereum/go-ethereum | 0 |
| github.com | ethereum/go-ethereum/eth | 0, 0 |
| github.com | ethereum/go-ethereum/consensus | 0 |
| ethereum | go-ethereum | < 1.9.24, * |
Timeline
- Nov 25, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 3, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 5, 2022 EPSS Score
- Sep 9, 2022 EPSS Score
- Nov 11, 2022 EPSS Score
References
- x_refsource_MISC
- x_refsource_CONFIRM
- x_refsource_MISC
- x_refsource_MISC
- https://github.com/advisories/GHSA-v592-xf75-856p advisory
- https://blog.ethereum.org/2020/11/12/geth_security_release url
- https://github.com/ethereum/go-ethereum url
- https://nvd.nist.gov/vuln/detail/CVE-2020-26240 advisory