gnosis / MultiSigWallet

Allows multiple parties to agree on transactions before execution.
https://github.com/gnosis/MultiSigWallet/releases
GNU Lesser General Public License v3.0
1.08k stars 767 forks source link

Denial of Service (DoS) #307

Open larrycameron80 opened 5 years ago

larrycameron80 commented 5 years ago

Denial of Service (DoS) Vulnerable module: mem Introduced through: solc@0.5.8 Detailed paths Introduced through: multisig-wallet-gnosis@gnosis/MultiSigWallet#584b7bc2aed581be740cd17aacd8f4f01a3e6cd1 › solc@0.5.8 › yargs@11.1.0 › os-locale@2.1.0 › mem@1.1.0 Remediation: Upgrade to solc@0.5.11. Overview mem is an optimization used to speed up consecutive function calls by caching the result of calls with identical input.

Affected versions of this package are vulnerable to Denial of Service (DoS). Old results were deleted from the cache and could cause a memory leak.