Nixpkgs Security Tracker

Login with GitHub

Suggestions search

With package: go-ethereum

Found 3 matching suggestions

updated 1 day, 14 hours ago by @LeSuisse Activity log
  • Created automatic suggestion
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
Go Ethereum affected by DoS via malicious p2p message

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sending a specially-crafted p2p message. The issue is resolved in the v1.17.0 release.

Affected products

go-ethereum
  • ==< 1.17.0

Matching in nixpkgs

Package maintainers

Upstream advisory: https://github.com/ethereum/go-ethereum/security/advisories/GHSA-689v-6xwf-5jf3
updated 1 day, 14 hours ago by @LeSuisse Activity log
  • Created automatic suggestion
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
Go Ethereum affected by DoS via malicious p2p message

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.

Affected products

go-ethereum
  • ==< 1.16.9

Matching in nixpkgs

Package maintainers

Upstream advisory: https://github.com/ethereum/go-ethereum/security/advisories/GHSA-2gjw-fg97-vg3r
Upstream patch: https://github.com/ethereum/go-ethereum/commit/895a8597cb16c02203e38707ed2d1da5c500fe60
updated 1 day, 14 hours ago by @LeSuisse Activity log
  • Created automatic suggestion
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.

Affected products

go-ethereum
  • ==< 1.16.9

Matching in nixpkgs

Package maintainers

Upstream advisory: https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8