CVE-2020-26265

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where vulnerable versions refuse to accept the canonical chain. The fix was included in the Paragade release version 1.9.20. No individual workaround patches have been made -- all users are recommended to upgrade to a newer version.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
GitHub_MCNA
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
VendorProductVersion
ethereumgo_ethereum
1.9.4 ≤
𝑥
< 1.9.20
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/ethereum/go-ethereum/releases/tag/v1.9.20
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4
https://github.com/ethereum/go-ethereum/releases/tag/v1.9.20
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4