CVE-2022-29219

{"id": "CVE-2022-29219", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-05-24T15:15:07.843", "references": [{"url": "https://github.com/ChainSafe/lodestar/pull/3977", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ChainSafe/lodestar/releases/tag/v0.36.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ChainSafe/lodestar/security/advisories/GHSA-cvj7-5f3c-9vg9", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ChainSafe/lodestar/pull/3977", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ChainSafe/lodestar/releases/tag/v0.36.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ChainSafe/lodestar/security/advisories/GHSA-cvj7-5f3c-9vg9", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted `AttesterSlashing` or `ProposerSlashing` being included on-chain. Because the developers represent `uint64` values as native javascript `number`s, there is an issue when those variables with large (greater than 2^53) `uint64` values are included on chain. In those cases, Lodestar may view valid_`AttesterSlashing` or `ProposerSlashing` as invalid, due to rounding errors in large `number` values. This causes a consensus split, where Lodestar nodes are forked away from the main network. Similarly, Lodestar may consider invalid `ProposerSlashing` as valid, thus including in proposed blocks that will be considered invalid by the network. Version 0.36.0 contains a fix for this issue. As a workaround, use `BigInt` to represent `Slot` and `Epoch` values in `AttesterSlashing` and `ProposerSlashing` objects. `BigInt` is too slow to be used in all `Slot` and `Epoch` cases, so one may carefully use `BigInt` just where necessary for consensus."}, {"lang": "es", "value": "Lodestar es una implementaci\u00f3n de TypeScript de la especificaci\u00f3n del Consenso de Ethereum. versiones anteriores a 0.36.0, se presenta una posible divisi\u00f3n del consenso debido a una inclusi\u00f3n en la cadena de \"AttesterSlashing\" o \"ProposerSlashing\" maliciosamente dise\u00f1ados. Debido a que los desarrolladores representan valores \"uint64\" como \"n\u00fameros\" nativos de javascript, se presenta un problema cuando esas variables con valores \"uint64\" grandes (mayores de 2^53) son incluidas en la cadena. En esos casos, Lodestar puede visualizar valid_\"AttesterSlashing\" o \"ProposerSlashing\" como inv\u00e1lidos, debido a errores de redondeo en valores \"num\u00e9ricos\" grandes. Esto causa una divisi\u00f3n del consenso, donde los nodos de Lodestar son bifurcados fuera de la red principal. Del mismo modo, Lodestar puede considerar inv\u00e1lidos los \"ProposerSlashing\" como v\u00e1lidos, incluyendo as\u00ed en bloques propuestos que ser\u00e1n considerados no v\u00e1lidos por la red. La versi\u00f3n 0.36.0 contiene una correcci\u00f3n para este problema. Como mitigaci\u00f3n, use \"BigInt\" para representar los valores \"Slot\" y \"Epoch\" en los objetos \"AttesterSlashing\" y \"ProposerSlashing\". \"BigInt\" es demasiado lento para ser usado en todos los casos de \"Slot\" y \"Epoch\", por lo que puede usarse cuidadosamente \"BigInt\" s\u00f3lo cuando sea necesario para el consenso"}], "lastModified": "2024-11-21T06:58:44.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chainsafe:lodestar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E25C300E-0B9D-4E88-B46F-546B68E73041", "versionEndExcluding": "0.36.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}